project risk management handbook: a scalable approach

Project Risk Management Handbook:

A Scalable Approach

Version 1 (June 2012)

Ris

k M

on

ito

rin

g

Risk Response

Qu

alitative

Risk A

nalysis

A LETTER FROM THE CHIEF ENGINEER WelcometothenewCaltransProjectRiskManagementHandbook.Webelievethatthisnewscalableapproachtomanagingprojectriskswillensurethatprojectrisksareknown,communicated,andacceptedastheymovethroughthephasesofprojectdelivery.ItisalsoanimportantelementoftheDepartment’sEnterpriseRiskManagement.AsurveywasconductedaspartofthedevelopmentofthishandbooktodeterminehowprojectriskmanagementwasbeingusedintheDepartmenttomanageprojectrisks.Thesurveyresponsesrevealedthatalthoughprojectriskmanagementisconsideredtobevaluable,manyrespondentsarenotfamiliarwiththecurrentProjectRiskManagementHandbookorhaveneverparticipatedindevelopingariskregister.Withthisinmind,thehandbookhasbeenupdatedwiththefollowingobjectives:

Itissimpleandeasytouse. Itisscalabletoprojectsizeandcomplexity. Itcommunicatesrisksacrossprojectmilestonesandphases. Itteacheshowtomanagerisksproactively. Itintegratesintothecurrentprocessesofprojectdelivery. Itisnotresource‐intensive.

Themanagementofrisksrequiresestablishingandnurturingacultureofriskmanagement.Insuchanenvironment,projectteamsworktogetherthrougheachphaseofprojectdeliverytomanagerisks.Theintentistobringfocustotheunderstandingthattheprojectteamsarenotonlydesigningroads,bridges,drainagesystems,etc.,butaredevelopingplans,specifications,andestimatesforconstructioncontracts.Projectriskmanagementiseveryone’sresponsibility,andthereareaccountabilitycheckpointstoensurethatprojectrisksarebeingmanaged.ThenewProjectRiskManagementHandbook:AScalableApproachisyourguidetoimplementingprojectriskmanagement.Itiswrittenasahandbookforallprojectteammemberstouseduringallphasesofdelivery.Trainingandsubjectmatterexpertsareavailabletohelpprojectteamseffectivelyimplementprojectriskmanagement.ItisourexpectationthatProjectDeliveryDirectivePD‐09istobeimplementedusingtheProjectRiskManagementHandbook:AScalableApproach.Ifyouhaveanyquestionsaboutitorhowtoimplementitforyourproject,pleasecontactyourDistrictRiskManagementCoordinator.BobPieplowActingChiefEngineerActingDeputyDirector,ProjectDelivery

SCALABLE PROJECT RISK MANAGEMENT

Version 1 (June 2012) Page 1

TABLE OF CONTENTS

PREFACE 2

CHAPTER 1 INTRODUCTION 3 Objectives and Benefits 3 1‐1 What is meant by “Risk” 4 1‐2 The Project Risk Management Process 5 1‐3 Three‐Tiered Scalability 6 1‐4 Organization 8 1‐5 Roles and Responsibilities 9 1‐6 Managing the Risk Register 10 1‐7 Communication in General 10 1‐8

CHAPTER 2 PLANNING PROJECT RISK MANAGEMENT 11 Creating the Project’s Risk Management Plan 11 2‐1 The Project Risk Management Team 11 2‐2 Incorporating Project Risk Management Activities into the Project Schedule 12 2‐3 The First Project Risk Management Meeting 12 2‐4

CHAPTER 3 RISK IDENTIFICATION 13 The Risk Register 13 3‐1 Identifying Project Risks 14 3‐2 Examples of Risk Statements 17 3‐3 Entering Data into the Risk Register 18 3‐4

CHAPTER 4 QUALITATIVE RISK ANALYSIS – LEVEL 1 19 Risk Assessment 19 4‐1 Entering Assessment into Risk Register Columns 19 4‐2

CHAPTER 5 QUALITATIVE RISK ANALYSIS – LEVEL 2 20 Probability and Impact Ratings for Level 2 Projects 20 5‐1 Performing Qualitative Risk Analysis 21 5‐2 Entering Assessments into the Risk Register 21 5‐3

CHAPTER 6 QUANTITATIVE RISK ANALYSIS – LEVEL 3 23 Quantifying the Risks 23 6‐1 Entering Quantifications into the Risk Register 24 6‐2 Producing the Risk Probability Curves 24 6‐3

CHAPTER 7 RISK RESPONSE 27 Risk Response Strategies 27 7‐1 Examples of Risk Responses 28 Responding to Risks 29 Entering Risk Responses into the Risk Register 29 7‐4

CHAPTER 8 RISK MONITORING 30 Risk Review and Updating 30 1‐1 Updating the Risk Register 31 1‐2 Lessons Learned 31 1‐3

CHAPTER 2 COMMUNICATION AND ACCOUNTABILITY 32 Communication and Accountability Checkpoints 32 2‐1 What Happens at a Communication Checkpoint 34 2‐2 What Happens at an Accountability Checkpoint 34 2‐3 What Happens at the Performance Measure Checkpoint 34 2‐4

ACRONYMS AND DEFINITIONS 35 APPENDIX A

RISK MANAGEMENT PLAN TEMPLATE 37 APPENDIX B

RISK REGISTER CERTIFICATION FORM 41 APPENDIX C

PD‐09 PROJECT RISK MANAGEMENT 42 APPENDIX D

PROJECT RISK MANAGEMENT STRUCTURE 47 APPENDIX E

ACKNOWLEDGEMENTS 50 APPENDIX F



Preface

TheProjectRiskManagementProcess,describedherein,isintendedtoresultintheeffectivemanagementofprojectrisksandopportunitiesduringtheentireprojectlifecycle–fromprojectinceptiontocompletionofconstruction.Theprojectmanager,projectsponsor,andprojectteammembersjointlydevelopariskregisterthatenablesthemtoidentify,assess,quantify,preparearesponseto,monitor,andcontrolprojectrisks.

Thisdocumentprovidesinformationtoprojectmanagersandprojectteamsthatwillhelpwiththeirriskmanagementeffortsinthefollowingways:

Provideaconsistentmethodologyforperformingprojectriskmanagementactivities.

Providetechniquesandtoolsforprojectriskmanagement.

Identifydatarequirementsforriskanalysisinputandoutput.

ProvideinformationonhowprojectriskmanagementfitsintotheoverallprojectmanagementprocessatCaltrans.

Provideguidanceonhowtoproactivelyrespondtorisks.

Projectriskmanagementisascalableactivitycommensuratewiththesizeandcomplexityoftheprojectunderconsideration.Simplerprojectsmayusesimpleanalysis,whereaslargermorecomplexprojectsmayusemorerobustanalysistechniques.

ThisScalableProjectRiskManagementHandbook,whichmayberevisedandupdatedfromtimetotime,isapplicabletoallprojects.Thelevelofprojectriskmanagementdependsonthetotalcostoftheproject,aswellasotherconsiderations(seeChapter1,Section1‐4).

Chapter1givesanoverviewofprojectriskmanagement,thethreelevelsofprojectriskmanagement,andtheprocess,roles,andresponsibilities.

Chapter2isdesignedtohelptheprojectmanagerplantheriskmanagementprocess,formtheprojectriskmanagementteam,andprepareabudgetforprojectriskmanagementactivities.

Chapter3providesinstructionaboutriskidentificationandstartingtheriskregister.Itisapplicabletoallscalabilitylevels.

Proceedtotheriskanalysischapterforthelevelofyourproject:

Level1 Chapter4

Level2 Chapter5

Level3 Chapter6

Chapters7through9arecommontoallprojects.Chapter7detailsriskresponse,andChapter8isaboutriskmonitoring.

Chapter9addressestherequiredcommunicationcheckpointsforallprojectsandexplainstherequiredaccountabilitycheckpointswheredeputiesmustsignoffontheriskregister.ItalsoincludestheRiskManagementPerformanceMeasurerequirements.



Chapter 1 Introduction

Objectives and Benefits 1‐1

Project Risk Management Objectives

TheProjectRiskManagementHandbookhasbeendesignedto:

Besimpleandeasytouse Bescalabletoprojectsizeandcomplexity Pullcommunicationofrisksacrossprojectmilestonesandphases Activelymanagerisktoenhanceprojectsuccess Integrateintothecurrentprojectdeliveryprocess,and Involveallfunctionalunitsinthemanagementofrisks.

Project Risk Management Values

Identifying,communicating,andmanagingprojectrisksrequiresariskmanagementculture.Thiscultureisdefinedbythevaluesinwhichweoperate.ThefollowingattributesdepictPRMvaluesrequiredforthedevelopmentofasuccessfulriskmanagementculture.

Riskdecision‐makingbasedonbalancingprojectvaluessuchascost,schedule,andquality Stewardship Efficiency Teamwork Jointownershipofrisksandresponsibilities Accountability

Benefits to the Project Team

Caltransprojectriskmanagementhelpstheprojectmanagerandtheotherprojectmemberstomanageprojectrisksoverthelifeofeachproject,enlistingthesupportandeffortofallofthefunctionalunitsastheprojectmovesalongthedeliverycycle.Thisincludes:

Betterabilityfortheprojectteamtofocustimeandeffortonhighestratedrisks Ascalableapproach,consistentwithexistingprocesses Enhancedcoordinationandtransparencywithfunctionalunits,whichfacilitatesearly

identificationofcriticalrisks Bridgingoffunctionalstovepipestomaintainfocusonprojectsuccessbyallfunctionalunits Supportoftheprojectmanager’smissionthroughthemanagementaccountabilityprocess



What is meant by “Risk” 1‐2

Themeaningoftheterm“risk”mustbeunderstoodclearlyforeffectiveprojectriskmanagement.Inthecontextofaproject,weareconcernedaboutpotentialimpactsonprojectobjectivessuchascostandtime.Ageneraldefinitionof“risk”inthiscontextis:

Riskisanuncertaintythatmatters;itcanaffectprojectobjectivesnegativelyorpositively.

Theuncertaintymaybeaboutafutureeventthatmayormaynothappenandtheunknownmagnitudeoftheimpactonprojectobjectivesifitdoeshappen.Thus,a“risk”ischaracterizedbyitsprobabilityofoccurrenceanditsuncertainimpactonprojectobjectives.

Thekindsofrisksappearinginariskregisterareshownbelowbasedonwhentheymightoccurduringthelifecycleofaproject.

Throughouttheprojectlifecycle,afutureeventthatmayoccuratanytimeinaproject’slifecycleisarisk.Ithasaprobabilityofoccurrenceandanuncertainimpactifitdoesoccur.

DuringPlanningandDesign,uncertaintyinthetotalcostestimate,duetouncertainquantitiesandunitpricesisarisk.Inthiscasetheprobabilityis100%(theestimateanditsuncertaintiesexist),andtheuncertaintiesimpacttheprojectcost.

Duringconstruction,aNoticeofPotentialClaim(NOPC)hasaprobabilityofbecomingaContractChangeOrder(CCO)andanuncertaincost/timeimpactifthishappens.ThisriskisretiredfromtheregisteriftheclaimisdismissedorifitisreplacedbyaCCO.

Duringconstruction,aCCOwhichhasoccurred(100%probability)isarisk,butitscost/timeimpactmaybeuncertain.IfthereisanestimateintheCCOLogoftheproject,theuncertaintyisexpressedasarangearoundtheestimate.ThisriskisretiredfromtheregisterwhentheCCOisexecutedwiththecontractor.

Theseexamplesarecollectivelyreferredtoas“risks”inthisHandbook,andwouldallbeincluded,whenapplicable,intheproject’sriskregisterbecausetheycontainuncertaintythataffectsprojectobjectives.

SpecificsaboutidentifyingrisksareinChapter3,includingexamplesofriskstatements.

Riskandissuearetwowordsthatareoftenconfusedwhenitcomestotheirusage.Actuallythereissomedifferencebetweenthem.

Ariskisanuncertaineventthathasaprobabilityassociatedwithit.Anissuedoesnothavethisattribute.Issuesareproblemsrightnowthattheprojectteamhastodosomethingabout.

Thinkofriskmanagementasaproactiveactivity,whileissuemanagementisreactive.



The Project Risk Management Process 1‐3

The Basic Process

Allapproachestoprojectriskmanagementstrivetomaximizebothefficiencyandeffectiveness.Althoughthedetailsofriskprocessesmaydifferdependingontheproject,riskmanagementhasthreeimportantparts:identification,analysis,andaction.Beforeriskcanbeproperlymanaged,itmustfirstbeidentified,described,understood,andassessed.Analysisisanecessarystep,butitisnotsufficient;itmustbefollowedbyaction.Ariskprocesswhichdoesnotleadtoimplementationofactionstodealwithidentifiedrisksisincompleteanduseless.Theultimateaimistomanagerisk,notsimplytoanalyzeit.

Theprojectriskmanagementprocess(Figure1)isnotdifficult.Itsimplyoffersastructuredwaytothinkaboutriskandhowtodealwithit.Afullprojectriskmanagementendeavorincludestheseprocesses:

1. RiskManagementPlanning–Decidinghowtoapproach,plan,andexecutetheriskmanagementactivitiesforaproject.

2. RiskIdentification–Determiningwhichrisksmightaffecttheprojectanddocumentingtheircharacteristics.

3. QualitativeRiskAnalysis–Prioritizingrisksforsubsequentfurtheranalysisoractionbyassessingandcombiningtheirprobabilityofoccurrenceandimpact.

4. QuantitativeRiskAnalysis–Analyzingprobabilisticallytheeffectofidentifiedrisksonoverallprojectobjectives.

5. RiskResponse–Developingoptionsandactionstoenhanceopportunitiesandtoreducethreatstoprojectobjectives.

6. RiskMonitoring–Trackingidentifiedrisks,monitoringresidualrisks,identifyingnewrisks,executingriskresponseplans,andevaluatingtheireffectivenessthroughouttheprojectlifecycle.

Atitsfoundation,projectriskmanagementinvolvesaskingandansweringafewsimplequestions:

Whatrisksmightnegatively(threats)orpositively(opportunities)affectachievingtheprojectobjectives?(Riskidentification)

Whichofthesearemostimportant?(Qualitativeriskanalysis)

Howcouldtheseaffecttheoveralloutcomeoftheprojectinprobabilistictermsofcostandschedule?(Quantitativeriskanalysis)

Whatcanbedoneaboutit?(Riskresponse)

Havingtakenaction,howdidtheresponseseffectchange,andwhereistheprojectnow?(Riskmonitoring)

Whoneedstoknowaboutthis?(Communication)

FIGURE 1 – PROJECT RISK MANAGEMENT PROCESS



Whilethesequestionsarelistedsequentiallyandareusuallyconductedinthisorder,theyareoftencombined,repeatedastheprojectprogresses,ormayevenbeperformedoutofsequence.

Thequestionsconstituteaprocess,showninFigure1,indicatinghowthedifferentelementsofprojectriskmanagementinteractanddescribinghowriskmanagementcanbeimplemented.Theprocesshasacircularformtohighlightthatitisacontinuousprocessthroughoutthelifecycleofaproject.

Thearrowssignifythelogicalflowofinformationbetweentheelementsoftheprocess.Communicationisthecoreofthisprocess.Itisthemeansbywhichalltheinformationflowsandtheprojectteamcontinuouslyevaluatestheconsistencyandreasonablenessofriskassessmentsandtheirunderlyingassumptions.

Three‐Tiered Scalability 1‐4

Arecentanalysisofthetotalcost(capitalandsupport)oftheDepartment’scurrentcontractsrevealedthefollowingbreakdown.Sixty‐sevenpercentofcontractsareunder$5million,30percentareintherangeof$5‐$100million,and3percentareover$100million.Accordingly,threerangeswereselectedforthescalabilitylevelsofProjectRiskManagement.TheriskmanagementrequirementsarelistedinTable1.

TABLE 1 – RISK MANAGEMENT REQUIREMENTS BY SCALABILITY LEVEL

Scalability Level

Estimated Cost (Capital and Support)

Risk Management Requirements

Minor A, Minor B, and other projects less than $1 million

Risk register encouraged

1 Less than $5 million Risk register

2 $5 million to $100 million Risk register with qualitative analysis

3 Greater than $100 million Risk register with quantitative analysis

Therequirementsperscalabilitylevelsareminimumrequirements.TheprojectteammaychoosetoworkatahigherscalabilitylevelthanrequiredorworkatalowerlevelifapprovedbytheSFP.However,theprojectteamshouldconsiderotherfactorstodeterminewhatlevelofriskmanagementeffortisneeded.Thesefactorsmayinclude:

Politicalsensitivity

Thetypeoftheproject

Locationoftheprojectandthecommunityitserves

Durationoftheproject

Stakeholdersoftheproject

Thesponsor’ssensitivitytotheprimaryobjectivesoftheproject(costandschedule).

Anyofthesefactorsmaywarrantemployingahigherscalabilitylevel.



TheactivitiesforeachScalabilityLevelareshowninTable2.

TABLE 2 – LEVELS OF PROJECT RISK MANAGEMENT SCALABILITY

Risk Management Process

Level 1 Cost to $5 M

Level 2 Cost $5‐100 M

Level 3 Cost over $100 M

Risk Identification Yes Yes Yes

Qualitative Analysis Risk Rating Probability/Impact

Matrix n/a

Quantitative Analysis n/a n/a Yes

Risk Response Yes Yes Yes

Risk Monitoring Yes Yes Yes

Communication Yes Yes Yes

ThelevelsdifferintheQualitativeandQuantitativeAnalysisprocesses.Alllevelsperformtheotherprocesses.Level3quantifiesrisksinprobabilisticforecasttermsofcostandtime,whereasLevels1and2donot.

Irrespectiveoftheproject’stotalcost,Level3mightbeusedifanyofthefollowingactivitiesarecontemplatedfortheproject:

Validatingtheproject’scontingencyallowance Justifyingandrequestingadditionalcontingencyabove5% Duringconstruction,checkingtheadequacyoftheremainingcontingency Duringconstruction,requestingsupplementalfunds Allocatingrisksofadesign‐buildproject Establishingthebudgetand/orcompletiontargetdatetoadesiredlevelofconfidence

MorecomplexprojectsmightrequestexemptionsdependingontheLevel3probabilisticcost.Level3analysismaybeusedinsupportofrevisionstotheproject’sprogrammingdollaramount.

Need more Contingency?

AccordingtoPD‐04,thereisaprocesstorequestmorecontingency:

"ContingencyApprovalProcess‐‐Whenthe5percentprojectcontingencymustbeincreasedordecreased,theprojectengineermustprepareamemorandumjustifyingtheneedandrequestedpercentageforcontingencies.Afullydevelopedriskmanagementplanwithaquantitativeriskassessmentwouldbeanacceptabledocumenttohelpjustifyanexceptiontothe5percentcontingency."Source:PD‐04ProjectContingenciesandSupplementalWork,AppendixA

AccordingtotheRTLGuide,thememorandumtorequestmorecontingencymusthavetheapprovaloftheDistrictDirector.



Organization 1‐5

TheProjectRiskManagementTeam(PRMT)isthecoregroupperforming,updating,andreviewingriskmanagementactivitiesunderthedirectionoftheProjectRiskManager(PRM),whohasbeentrainedintheprocesses.ThePRMTwillincludemembersofthePDT,butnotnecessarilyallmembers.ThePRMTriskmanagementmeetingsmaybescheduledtofollowthePDTmeeting.

ThePRMTcomprisesCaltransprojectpersonnelfromDesign,Construction,ProjectManagement,andtheFunctionalUnitsinvolvedintheproject.ThemembersofthePRMTshouldcollectivelyhavealloftheexpertiserequiredtoidentify,assess,andrespondtorisksoftheproject.However,theyshouldnothesitatetodrawontheextensivetalentpoolavailabletotheprojectforassistance.Representativesfromotheragencies,ifany,maybeinvitedtoparticipateatPRMTmeetingstoensurethatallpartiesarefullyinformed,andthusavoidsurprises.

ThePRMTisdirectedbythePRM.TheprojectmanagergenerallyactsasthePRMforLevel1and2projects.

InschedulingPDTmeetings,theprojectmanagershouldindicatewhenriskdiscussionswillbeontheagendasothatPRMTmemberscanplantoattendforriskdiscussionsaswellasotheragendaitems.

Discussing Risks as a Team has Value

Conductingriskmanagementmeetingsasateamhasvalue.Theteamlistenstoitsmembersdiscussrisks,andtheteamcanprovideinputfromdifferentperspectives.Thiscannotoccurinone‐on‐onediscussionsofrisk.Indiscussingrisks,theworkofindividualteammemberscanhaveanimpactontheworkoftherestoftheteam.Listeningtoteammembers,anddiscussingtheirchallenges,providesagreaterlikelihoodthattheimpactofariskwillbeassessedproperly.



Roles and Responsibilities 1‐6

TABLE 3 –PROJECT RISK MANAGEMENT ROLES AND RESPONSIBILITIES

Role Responsibilities

Project Managers

With input from the Project Development Team (PDT), determine the project’s risk register requirements based on project estimate and complexity, and the need for a written project Risk Management Plan.

Promote and direct risk management for the project.

Request project‐specific changes to minimum risk management requirements.

Populate and maintain the project risk register with risks developed by functional units and the PRMT.

Ensure proactive response to all risks and opportunities that will impact the successful delivery of the project.

Produce risk management reports for sponsors.

Inform Department management about risk management results, major issues, and concerns.

Schedule and conduct project risk meetings.

Monitor and update risks.

Ensure quality of the risk data in the risk register.

Track and monitor the effectiveness of risk response actions.

Elevate issues to district management for resolution as necessary.

Take lead role in obtaining signoffs at accountability check points.

District Risk Management Coordinator

Assist project managers with the implementation of PRM requirements.

Provide expertise, direction, and assistance.

Obtain expert services as needed.

Liaise with Headquarters risk management.

Project Delivery Team Member

Identify and assess risks.

Develop responses to risks.

Document risk response actions and report to project manager for inclusion in risk management updates.

Communicate with project manager about newly‐identified risks, risk assessments, and retirement of risks.

Project Risk Manager

(Generally the project manager for Level 1 and 2 projects)

Promote and direct risk management for the project.

Schedule and conduct project risk meetings.

Perform risk monitoring and updating.

Ensure quality of the risk data in the Risk Register.

Document risk response actions.

Track and monitor the effectiveness of risk response actions.

Report to the project manager on all matters related to risk management.

Compile the lessons learned in the area of risk management.

Produce risk management reports for the project manager.

Populate the project risk register with risks developed by functional areas.

Project Delivery Team Members and Task Managers

Identify and assess risks and determine the risk owners.

Develop responses to risks.

Document risk response actions and report to project managers for inclusion in risk management updates.

Communicate new risks to project managers.

Retire risks.



Managing the Risk Register 1‐7

Theproject’sprojectriskmanagerfacilitatestheriskmanagementprocess,ensuresthatthePRMTfullyvetstheriskregister,andmakessurethatdisputesareresolved.

Communication with Functional Units

Theprojectmanagerinitiatestheprojectriskmanagementprocessand“owns”ituntiltheprojectiscompleted.TheprojectmanagershouldinvolveallfunctionalunitsandConstructionintheriskmanagementprocessfrominceptiontoprojectcompletion.

Communication and Accountability Checkpoints

Althoughriskscanandshouldbediscussedwithprojectteammembersandmanagementatanytimeduringthecourseofaproject,itisdesirabletohave“checkpoints”toensuretheprojectdoesnotunnecessarilyproceedonacourseofactionthatmaynotbefeasibleandmaybechangedlaterbyadecision‐maker.

ThecommunicationandaccountabilitycheckpointsaredetailedinChapter2.TheyarerelativetotheexistingstandardmilestonesintheCaltransWorkBreakdownStructure.Thelatestriskregisteriscommunicatedateachcheckpoint.Theriskregisteristobeapprovedandsigned‐offbytheDeputiesattheaccountabilitycheckpoints.

Communication in General 1‐8

Communicationandconsultationwithprojectstakeholdersareacrucialfactorinundertakinggoodriskmanagementandinachievingprojectoutcomesthatarebroadlyaccepted.Ithelpseveryonetounderstandtherisksandtrade‐offsthatmustbemadeinaproject.Communicationensuresthatallpartiesarefullyinformed,andthusavoidsunpleasantsurprises.

Regularreportingisanimportantcomponentofcommunication.Reportsonthecurrentstatusofrisksandriskmanagementarerequiredformanagersandotherpartiestounderstandtherisks.Theycomplementothermanagementreportsindevelopingthisunderstanding.Theprojectriskmanagerwillprepareandissueperiodicriskmanagementreportsasrequiredbytheprojectmanager

Toensureaclearaudittrail,theprojectriskmanagerwillensurethattheriskmanagementprocessisdocumentedinsuchawaythatitcanbereviewed,thestructureandassumptionscanbeexamined,andthereasonsforparticularjudgmentsanddecisionscanbeidentified.



Chapter 2 Planning Project Risk Management

Creating the Project’s Risk Management Plan 2‐1

AwrittenRiskManagementPlanisnotrequiredforallprojects.Itdependsontheprojectsizeandcomplexityandtheamountofriskmanagementeffortthatwillberequired.TheprojectmanagerandthePDTmaydecideifitisnecessary.

TheRiskManagementPlan(RMP)definesthelevelatwhichriskmanagementwillbeperformedfortheprojectandthefrequencyofriskmanagementmeetingsandriskregisterupdates.ItliststhemembersoftheProjectRiskManagementTeambythevariousdisciplinesinvolvedintheprojectandsetsabudgetfortheriskmanagementactivities.TheRMPshouldbecompletedearlyinprojectplanning,sinceitiscrucialtosuccessfullyperformingtheotherprocessesdescribedherein.

AProjectRiskManagementPlantemplateisshowninAppendixBandmaybedownloadedfrom:http://onramp/riskmanagement

Thisstepwillensurethatthelevel,type,andvisibilityofriskmanagementarecommensuratewithboththeriskandimportanceoftheprojecttotheorganization,providesufficientresourcesandtimeforriskmanagementactivities,andestablishanagreed‐uponbasisforevaluatingrisks.

Firststeps:

Determinethescalabilitylevelfortheproject.

Downloadtheriskregisterforthescalabilitylevelfrom:http://onramp/riskmanagement.

Determinethefrequencyofriskmeetingsfortheprojectandtheapplicablecommunicationandaccountabilitycheckpoints.

DecidewhowillbeontheProjectRiskManagementTeam.

Ifsignificanteffortoroutsideconsultantswillbeinvolved,includeestimatesforprojectriskmanagementactivitiesinworkplans.

Ifapplicable,obtainthenecessaryapprovalsforthewrittenRMP.

The Project Risk Management Team 2‐2

TheProjectRiskManagementTeam(PRMT)isthecoregroupperforming,updating,andreviewingriskmanagementactivitiesunderthedirectionoftheprojectriskmanager.ThePRMTwillincludemembersofthePDT,butnotnecessarilyallmembers.

ThePDTmaynotcontinueregularmeetingsafterRTL.EmphasizethatthePRMTisexpectedtostaytogethertomanagerisksuntilprojectcompletion.



Incorporating Project Risk Management Activities into the Project Schedule 2‐3

Theprojectschedule(workplan)shouldincorporatethefollowing:

Datesforprojectriskmanagementmeetings

Timetoallowteammemberstoprepareforreviewoftheriskregisterandriskresponses

Milestonesforcommunicationandaccountabilitycheckpoints(seeChapter2)

The First Project Risk Management Meeting 2‐4

ThefirsttimethatthePRMTmeets,theprojectmanagershouldbrieftheteamaboutthefollowing:

Theimportanceandobjectivesoftheprojectriskmanagementprocess

Theprocessitself

Therolesandresponsibilities

Theriskregister

Thecommunicationandaccountabilitycheckpoints

Riskmanagementactivitiesintheprojectschedule

Timechargecodesforriskmanagementactivities

Theexpectationthatriskwillbemanaged,documented,andreported

Atthisfirstmeeting,elicitrisksfromtheteammembers.IfworkingtoLevel2scalability,determinetheimpactandprobabilitydefinitionssothattheteamhasthesameunderstandingofthemeaningoftheworddescriptions.(SeeTable5onpage20forguidance.)

ThePDTmayincludeexternalstakeholdersandagenciesinadditiontoCaltranspersonnel.AtPDTmeetings,afterregularPDTbusinessisconcluded,thePRMTmembersfromthePDTcanremaintoconductaprojectriskmanagementmeeting.



Chapter 3 Risk Identification

Riskidentificationdetermineswhatmighthappenthatcouldaffecttheobjectivesoftheprojectandhowthosethingsmighthappen.Itproducesadeliverable—theprojectriskregister–thatdocumentstherisksandtheircharacteristics.Theriskregisterissubsequentlyamendedbythequalitativeorquantitativeriskanalysis,riskresponse,andriskmonitoringprocesses.Riskidentificationisaniterativeprocessbecausenewrisksmaybecomeknownastheprojectprogressesthroughitslifecycle,previously‐identifiedrisksmaydropout,andotherrisksmaybeupdated.

“Risk” Includes Threats and Opportunities

Theconceptofriskcanincludepositiveandnegativeimpacts.Thismeansthattheword“risk”canbeusedtodescribeuncertaintiesthat,iftheyoccurred,wouldhaveanegativeorharmfuleffect.Thesamewordcanalsodescribeuncertaintiesthat,iftheyoccurred,wouldbehelpful.Inshort,therearetwosidestorisk:threatsandopportunities.

Projectsindesignhavethegreatestpotentialforopportunitiesbecausetheprojectisstillopentochanges.Riskreductionandavoidanceareopportunities,asarevalueanalyses,constructabilityreviews,andinnovationsindesign,constructionmethods,andmaterials.

Onceaprojectentersconstruction,theprojectobjectives(scope,time,andcost)arefixedcontractually,soopportunitiestosavemoneyandtimearefewer.Anychangesmustbemadeusingacontractchangeorder(CCO),andonlyanegativeCCOsuchasoneresultingfromaValueEngineeringChangeProposalbythecontractorwouldstillaffordanopportunitytosavemoneyandtime.Otherwise,CCOsaddcostand/ortimetotheproject.So,theriskmanagementfocusduringconstructionisonreducingoreliminatingrisks.

The Risk Register 3‐1

What it is

Ariskregisterisatoolthatprojectteamscanusetoaddressanddocumentprojectrisksthroughouttheprojectlifecycle.Itisalivingdocument–acomprehensivelistingofrisksandthemannerinwhichtheyarebeingaddressedaspartoftheprojectriskmanagementprocess.Theriskregisterismaintainedaspartoftheprojectfilethatalsoincludesinformationrelatedtouncertaintiesinthecostestimateandschedule.

Riskregistertemplatesforeachscalabilitylevelcanbedownloadedfrom:http://onramp/riskmanagement

Why use it

Anewprojectteamisformedforeveryprojectanddisbandedwhentheprojectiscomplete.Althoughnotdesirable,projectteammemberssometimeschange,andtheprojectexperienceschangeoverthecourseoftheproject.Communicationamongprojectteammembersabouttheprojectobjectives,costs,risks,etc.,isvital.Theriskregistercommunicatesprojectrisksandhelpstheteammembersunderstandthestatusoftherisksasaprojectmovesfrominceptiontowardcompletion.

Managersshouldviewtheriskregisterasamanagementtoolthroughareviewandupdatingprocessthatidentifies,assesses,manages,andreducesriskstoacceptablelevels.

Mo

nit

ori

ng

& C

on

tro

l

Response

Planning



When to use it

Ariskregisterisrequiredtobepreparedinconjunctionwiththefirstpublishedcostandscheduleestimateofaproject(atthePIDphase).Thereafter,afullreviewandupdateoftheriskregistershouldbeundertakenatthebeginningofeachsubsequentphaseoftheproject.Theregisterwillbeupdatedatleastquarterlyduringtheconstructionphaseoftheproject.

How to use it

Ariskregisterisbestusedasalivingdocumentthroughouttheproject’sentirelifecycle,fromPIDthroughconstruction,torecordtheevolutionofprojectrisks.Thereisnoprescriptionforhowextensiveaproject’sriskregistershouldbe.Theprojectteamdecidesthemostbeneficialuseoftheriskregister,withtheobjectiveofminimizingtheriskimpact.

Resolving Disputes

Successfulimplementationofariskmitigationmeasureisoneofthemostimportantaspectsofprojectriskmanagement.WhenPRMTmembersareatoddsonwhetherornotthesemeasurescanbeimplemented,thedisputeshouldbeelevatedtoassistinitsresolution.TheteamshouldhaveaDisputeResolutionLadder(DRL)thatoutlineswhenandhowdisputeswillbeelevatedandsubsequentlyresolved.TheDRLshouldbecreatedintheinitialPRMTmeetingandusedthroughoutthelifeoftheproject.

Disputesshouldbeelevatedonceallrelevantinformationisknown,andagreementisnotreachedoradecisioncannotbemade.

Example Dispute Resolution Ladder

PM facilitates resolution and elevation

If unresolved among PRMT members Elevate to Functional Manager(s)

If unresolved by Functional Manager(s) Elevate to Deputies

ItisimportanttonotethatthedisputemayberesolvedbytheDepartmentacceptingtheriskandnotimplementingthemitigationmeasure.

Identifying Project Risks 3‐2

Thefirsttimethatriskmanagementisappliedtoaproject,theprojectriskmanagerconvenesthePRMTtoidentifyandassessrisks.Riskidentificationdocumentsrisksthatmightaffecttheprojectandtheircharacteristicsofprobabilityandimpact.

Acommonchallengeinriskidentificationisavoidingconfusionbetweencausesofrisk,genuinerisks,andtheeffectsofrisks.Ariskmayhaveoneormorecausesand,ifitoccurs,oneormoreeffects.

Causesaredefiniteeventsorsetsofcircumstanceswhichexistintheprojectoritsenvironment,andwhichgiverisetouncertainty.Examplesincludetheneedtouseanunprovennewtechnology,thelackofskilledpersonnel,orthefactthattheorganizationhasneverdoneasimilarprojectbefore.Causesthemselvesarenotuncertainsincethey



arefactsorrequirements,sotheyarenotthemainfocusoftheriskmanagementprocess.

Risksareuncertaintieswhich,iftheyoccur,wouldaffecttheprojectobjectiveseithernegatively(threats)orpositively(opportunities).Examplesincludethepossibilitythatplannedcompletiontargetsmightnotbemet,escalationratesmightfluctuate,orthechancethatrequirementsmaybemisunderstood.Theseuncertaintiesshouldbemanagedproactivelythroughtheriskmanagementprocess.

Effectsareunplannedvariationsfromprojectobjectives,eitherpositiveornegative,whichwouldariseasaresultofrisksoccurring.Examplesincludeearlymilestonecompletion,exceedingtheauthorizedbudget,orfailingtomeetagreedqualitytargets.Effectsarecontingentevents,unplannedpotentialfuturevariationswhichwillnotoccurunlessriskshappen.Aseffectsdonotyetexist,andtheymayneverexist,theycannotbemanageddirectlythroughtheriskmanagementprocess.

Includingcausesoreffectsinalistofidentifiedrisksobscuresgenuinerisks,whichmaynotreceivetheappropriatedegreeofattentiontheydeserve.Onewaytoclearlyseparaterisksfromtheircausesandeffectsistouseadescriptionwithrequiredelementstoprovideathree‐partstructured“riskstatement”:“Asaresultof<definitecause>,<uncertainevent>mayoccur,whichwouldleadto<effectonobjective(s)>.”

Examplesinclude:

“Asaresultofusinganewtechnology(adefiniterequirement),unexpecteddesignproblemsmayoccur(anuncertainrisk),whichwouldleadtooverspendingontheproject(aneffectonthebudgetobjective).”

“Becauseourorganizationhasneverdoneaprojectlikethisbefore(fact=cause),wemightmisunderstandtherequirements(uncertainty=risk),andourprojectwouldnotmeettheperformancecriteria(contingentpossibility=effectonobjective).”

At the risk identification stage, the impacts on cost and time are not analyzed – that happens in the qualitative risk analysis (Chapter 4) or quantitative risk analysis (Chapter 5) processes.

Theteammembersidentifythepotentialrisks(threatsandopportunities)usinganycombinationof:

Brainstorming, Challengingofassumptions, Lookingfor“newness”(e.g.newmaterials,technology,orprocesses), Theirknowledgeoftheprojectorsimilarprojects, Consultationwithotherswhohavesignificantknowledgeoftheprojectoritsenvironment, Consultationwithotherswhohavesignificantknowledgeofsimilarprojects,and Theexperienceofprojectstakeholdersorothersintheorganization.

AlistoftypicalrisksfromthepreviousCaltransriskmanagementhandbookmaybedownloadedfrom:

http://onramp/riskmanagement

Thelistisforguidanceonly.Itisnotintendedasanexhaustivelist,norisitasubstituteforothermethodsofidentifyingrisks.Someoftheitemsareissuesandnotrisks(Thedifferenceisexplainedinthesidebaronpage4).



Inidentifyingrisks,theteamconsidersanddocuments:

Whatmayhappenornotgoaccordingtoplan,

Whattheimpactstotheprojectobjectiveswouldbeshouldtheriskarise,

Whattheassumptionsandcurrentstatusarethatsupporttheassessmentoftherisk,

Whataction,ifany,hasbeentakentorespondtotherisk,and

Whatfurtheroptionsmightbeavailableforrespondingtotherisk?

Theinformationisenteredintotheriskregister.EachriskisassignedtoamemberofthePRMTwhobecomesitsRiskOwner.Theriskregisterisreviewedandupdatedthroughouttheproject.

Theprojectmanager,athisoption,mayelicitinitialriskregistersfromthefunctionalunitsandconsolidatethecontributionsintoasingleprojectriskregister.Alternatively,theprojectriskregistermaybedevelopedduringaPRMTmeeting.

DIFFERING SITE CONDITIONS

Accesstoallareasofaprojectsitemaynotbeavailablepriortoconstruction.Thismakesitdifficulttodetermineenvironmentallysensitiveareasorsubsurfaceinformationneededtodesignroadwaysandfoundations.Theteamneedstorecognizetheuncertaintythatarisesfromthislackofinformationandprovidethemeanstoaddressitintheconstructionphase.

Someoptionsforaddressingtherisksfromunknownconditions:

1. Executeaservicecontracttodeterminetheinformationduringthedesignphase,andrevisecontractdocumentsaccordingly.

2. ProvidelanguageintheSpecialProvisionsforthecontractortoprovideaccesstothejobsitefortheDepartment'spersonnelasafirstorderofwork.

3. ProvidelanguageintheSpecialProvisionsforthecontractortoholdoffonorderingmaterialswhosequantitymaybeimpactedbythisnewinformation.

4. Provideresourcesfordesignpersonneltoperformatimelydesign/assessmentusingthenewinformation.



Examples of Risk Statements 3‐3

TABLE 4 – EXAMPLE RISK STATEMENTS FROM CALTRANS PROJECTS

Risk Statement

Design

Inaccuraciesorincompleteinformationinthesurveyfilecouldleadtoreworkofthedesign.

AdesignchangethatisoutsidetheparameterscontemplatedintheEnvironmentalDocumenttriggersasupplementalEIRwhichcausesadelayduetothepubliccommentperiod.

Environmental

Potentiallawsuitsmaychallengetheenvironmentalreport,delayingthestartofconstructionorthreateninglossoffunding.

Nestingbirds,protectedfromharassmentundertheMigratoryBirdTreatyAct,maydelayconstructionduringthenestingseason.

R/W

Duetothecomplexnatureofthestaging,additionalrightofwayorconstructioneasementsmayberequiredtocompletetheworkascontemplated,resultinginadditionalcosttotheproject.

Duetothelargenumberofparcelsandbusinesses,thecondemnationprocessmayhavetobeusedtoacquireR/W,whichcoulddelaystartofconstructionbyuptooneyear,increasingconstructioncostsandextendingthetimeforCOS.

Construction

Hazardousmaterialsencounteredduringconstructionwillrequireanon‐sitestorageareaandpotentialadditionalcoststodispose.

Unanticipatedburiedman‐madeobjectsuncoveredduringconstructionrequireremovalanddisposal,resultinginadditionalcosts.

IMPORTANCE OF SITE VISITS

Sitevisitsduringthedesignphaseareaneffectiveriskmanagementstep.Notvisitingthesitecreatesuncertaintiesaboutconditions,whichmustberecognizedasrisks.

Forexample,aprojectinSouthSanFranciscousedtheas‐builtsforthecontracttodeterminetheexistingconditions.Theprojectteamwasunawarethattheworkwaspartofacorridorprojectconstructedunderseveralcontracts.Theplansneglectedtoshowthealignmentofseveralrampsinthepreviously‐constructedinterchange.Thisriskcouldhavebeenpreventedwithasitevisit.Inthisinstance,thedesignwasperformedbyanotherdistrict,andtraveltothejobsitewasdeemedimpractical.Consequently,risksstemmingfromsiteconditionswerenotidentified.Fortunately,theimpactofomittingas‐builtconditionswasquicklyidentifiedandmitigatedinconstruction.Whilethistimelyactionreduceddelaystotheproject,significantcontingencyfundswereexpended,necessitatingarequestforsupplementalfunds.



Entering Data into the Risk Register 3‐4

Theimageshereinarefromthespreadsheetversionoftheriskregisterforeachscalabilitylevel.

Aworkbookcontainingasheetforeachscalabilitylevelriskregistermaybedownloadedfrom:

http://onramp/riskmanagement

Atthisstage,completetheinformationinthefollowingriskregistercolumns:

Column Contents

Status Select “Active” or “Retired.” A risk is retired when it has no further possibility of impacting the project.

ID # Enter a unique identifying number for the risk.

Risk Type (Levels 1 and 2 only)

Enter either a “Threat” or an “Opportunity,”

Category Select one of the categories for the risk. (Environmental, Design, R/W, DES, Construction, External, Organizational, or PM)

Threat/Opportunity Event Provide a descriptive title for the risk.

Description Write a complete description of the event and its potential impacts on the project if this risk were to occur. See Section 3‐2 for the structure of the risk statement.

Current Status/Assumptions If applicable, describe what we currently know about the risk and any assumptions made.

Risk Owner Enter the name of the PRMT member responsible for this risk.

Updated Enter the date the risk was created.

Othercolumnsintheriskregisterwillbecompletedorupdatedbythequalitative(Chapter4)orquantitative(Chapter5)riskanalysisandriskresponseprocessesinChapter7.

PreviouseditionsofriskregistersusedintheDepartmenthaveacolumnfortherisk“trigger,”butnotmanyriskshaveacleartrigger.Soasnottotakespacefromacrowdedriskregister,ifatriggerisidentifiedforarisk,itshouldbedescribedinrelationtotheriskresponse.



Chapter 4 Qualitative Risk Analysis – Level 1

Qualitativeriskanalysisincludesmethodsforprioritizingtheidentifiedrisksforfurtheraction,suchasriskresponse.ThePRMTcanimprovetheproject’sperformanceeffectivelybyfocusingonhigh‐priorityrisks.

Teammembersrevisitqualitativeriskanalysisduringtheproject’slifecycle.Whentheteamrepeatsqualitativeanalysisforindividualrisks,trendsmayemergeintheresults.Thesetrendscanindicatetheneedformoreorlessriskmanagementactiononparticularrisksorevenshowwhetherariskmitigationplanisworking.

Risk Assessment 4‐1

QualitativeriskanalysisforLevel1projectsassignsaRiskRatingtoeachriskintheriskregister.Theriskratingsdeterminewherethegreatesteffortshouldbefocusedinrespondingtotherisks.Theyfacilitatestructuredriskresponseactionandresourceallocation.

ThethreeratingsforLevel1projectsare:

“High”–Firstpriorityforriskresponse.

“Medium”–Riskresponseastimeandresourcespermit.

“Low”–Noriskresponserequiredatthistime.

Entering Assessment into Risk Register Columns 4‐2

ThequalitativeriskanalysisofeachriskisenteredintothefollowingcolumnsoftheLevel1riskregister.

Column Contents

Risk Rating Select “High”, “Medium”, or “Low” as a measure of the importance of this risk for response action.

Rationale Describe the reasons the PRMT selected this risk rating.

OthercolumnsintheriskregisterwillbecompletedorupdatedbytheriskresponseprocessinChapter7.

Mo

nit

ori

ng

& C

on

tro

l

Response

Planning



Chapter 5 Qualitative Risk Analysis – Level 2

Qualitativeriskanalysisincludesmethodsforprioritizingtheidentifiedrisksforfurtheraction,suchasriskresponse.ThePRMTcanimprovetheproject’sperformanceeffectivelybyfocusingonhigh‐priorityrisks.

Teammembersrevisitqualitativeriskanalysisduringtheproject’slifecycle.Whentheteamrepeatsqualitativeanalysisforindividualrisks,trendsmayemergeintheresults.Thesetrendscanindicatetheneedformoreorlessriskmanagementactiononparticularrisksorevenshowwhetherariskmitigationplanisworking.

QualitativeriskanalysisforLevel2projectsassessesthepriorityofidentifiedrisksusingtheirprobabilityofoccurringandthecorrespondingimpactonprojectobjectivesiftherisksoccur.

Probability and Impact Ratings for Level 2 Projects 5‐1

Table5liststheCaltransstandarddefinitionofriskprobabilityandimpactratings.Thecostimpactratingsmaybeeasiertoapplyifexpressedintermsofdollars.TheratingsfortheprojectserveasaconsistentframeofreferenceforthePRMTinassessingtherisksduringthelifeoftheproject.

Thetableisintendedasaguide–thePRMTmaydefinedollarandtimerangesasappropriatefortheproject.Theimpactsaretotheoverallproject.Scheduledelayappliestorisksthatareonthecriticalpath(thelongestpath).DuringthePlanningandDesignphase,delayimpactstoRTLmaybeofprimaryinterest.Duringconstruction,delaysimpactprojectcompletion.

CostimpactsarebasedonthesumofCapitalOutlay(CO)andCapitalOutlaySupport(COS)costs.

TABLE 5 –DEFINITIONS OF IMPACT AND PROBABILITY RATINGS

Rating --> Very Low Low Moderate High Very High

Cost Impact of Threat (CO + COS)

Insignificant cost increase

<5% cost increase

5‐10% cost increase

10‐20% cost increase

>20% cost increase

Cost Impact of Opportunity (CO + COS)

Insignificant cost

reduction

<1% cost decrease

1‐3% cost decrease

3‐5% cost decrease

>5% cost decrease

Schedule Impact of Threat

Insignificant slippage

<1 month slippage

1‐3 months slippage

3‐6 months slippage

>6 months slippage

Schedule Impact of Opportunity

Insignificant improvement

<1 month improvement

1‐2 months improvement

2‐3 months improvement

>3 months improvement

Probability 1–9% 10–19% 20–39% 40–59% 60–99%

Mo

nit

ori

ng

& C

on

tro

l

Response

Planning



Performing Qualitative Risk Analysis 5‐2

ThePRMTassesseseachidentifiedriskinturnandassesses:

Theratingfortheprobabilityoftheriskoccurring,and

Theratingofcostandtimeimpactofeachrisk,shoulditoccur.

TheriskmatrixinFigure2isusedtodeterminetheimportanceofeachriskimpactbasedontheprobabilityandimpactratings.Eachworddescriptoroftheratinghasanassociatednumber;theproductoftheprobabilitynumberandimpactnumberdefinestheriskscore.

FIGURE 2 – CALTRANS RISK MATRIX

Foraparticularimpact,thecombinationoftheprobabilityratingoftheriskoccurringandtheimpactratingpositionstheriskintooneofthethreecoloredzonesintheriskmatrix.Thecolorofthezoneindicatesthepriorityoftheriskforriskresponse:redzonesignifieshighimportance,yellowismediumimportance,andgreenislowimportance.

Forexample,ariskhavinga“Moderate”probabilityanda“High”impactfallsintotheredzone.Itsimpactscoreis3x8=24.

Entering Assessments into the Risk Register 5‐3


Column Contents

Probability Select the probability level from the drop‐down list.

Cost Impact Select the cost impact level from the drop‐down list.

Time Impact Select the time impact level from the drop‐down list.

Rationale Describe the rationale for these assessments.

The“CostScore”isequaltotheProbabilitynumbertimestheCostImpactnumber.

Pro

bab

ilit

y R

atin

g 5 – Very High

4 – High 3 – Moderate 2 – Low 1 – Very Low

1

Very Low 2

Low 4

Moderate 8

High 16

Very High

Impact Rating



The“TimeScore”isequaltotheProbabilitynumbertimestheTimeImpactnumber.

TherisksinacoloredzonemaybefurtherprioritizedforriskresponseaccordingtotheirCostandTimeScores.Thehigherthescore,thehigherthepriorityforriskresponseandmonitoring.




Chapter 6 Quantitative Risk Analysis – Level 3

Level3willrequireexpertiseandtraining.PleaseseetheDistrictRiskManagementCoordinatorforguidance.

Quantitativeriskanalysisisawayofnumericallyestimatingtheprobabilitythataprojectwillmeetitscostandtimeobjectives.Quantitativeanalysisisbasedonasimultaneousevaluationoftheimpactofallidentifiedandquantifiedrisks,usingMonteCarlosimulationby@Risk,CrystalBall,orPrimaveraRiskAnalysissoftware.Theresultisaprobabilitydistributionoftheproject’scostandcompletiondatebasedontheidentifiedrisksintheproject.

Quantitativeriskanalysissimulationstartswiththemodeloftheprojectandeitheritsprojectscheduleoritscostestimate,dependingontheobjective.Thedegreeofuncertaintyineachscheduleactivityandeachline‐itemcostelementisrepresentedbyaprobabilitydistribution.Theprobabilitydistributionisusuallyspecifiedbydeterminingtheoptimistic,themostlikely,andthepessimisticvaluesfortheactivityorcostelement.Thisistypicallycalledthe“3‐pointestimate.”Thethreepointsareestimatedbytheprojectteamorothersubjectmatterexpertswhofocusonthescheduleorcostelementsoneatatime.

Specializedsimulationsoftwareruns(iterates)theprojectscheduleorcostestimatemodelmanytimes,drawingdurationorcostvaluesforeachiterationatrandomfromtheprobabilitydistributionderivedfromthe3‐pointestimatesforeachelement.Thesoftwareproducesaprobabilitydistributionofpossiblecompletiondatesandprojectcosts.Fromthisdistribution,itispossibletoanswersuchquestionsas:

Howlikelyisthecurrentplantocomeinonscheduleoronbudget?

Howmuchcontingencyreserveoftimeormoneyisneededtoprovideasufficientdegreeofconfidence?

Whichactivitiesorline‐itemcostelementscontributethemosttothepossibilityofoverrunningscheduleorcosttargetscanbedeterminedbyperformingsensitivityanalysiswiththesoftware.

Quantifying the Risks 6‐1

TheprojectriskmanagerleadsthePRMTinquantifyingcostandschedulerisks.

Theprobabilityoftheriskoccurringisexpressedbytwovalues:“Low”and“High”thatcovertherange.

Three‐pointestimatesareusedforcostandscheduleimpacts.Thethree‐pointestimateconsistsofdeterminingthe“Low”(optimistic),“High”(pessimistic)and“MostLikely”valuesforthecostandtime.Themostlikelyvaluemaybeomittedifitcannotbeestablishedcredibly.

Thecostimpactsincludedirectcostsonly;theyexcludeanycostofdelay(determinedfromtheoutputofascheduleriskanalysis–see“ScheduleRiskAnalysis”onpage25).Scheduleimpactsareexpressedindaysofpotentialdelayduetotherisk.Somerisksmaynothavebothcostandscheduleimpacts.

Mo

nit

ori

ng

& C

on

tro

l

Response

Planning

Qu

alitative

An

alysis



PotentialprojectdeliveryscheduledelayscanimpactRTLandconstructionduration.ThecostofpotentialdelaytoRTLmaybeariskitemintheriskregister.

Thepotentialdelayduringconstructionisconvertedtocostusingadailyratethatincludestime‐relatedoverheadandthedirectcostsassociatedwithtime(equipment,etc.).ItiscarriedintheriskregisterseparatelyfromtheRTLdelayrisk.

Entering Quantifications into the Risk Register 6‐2


Column(s) Contents

Probability Enter the “Low” to “High” values.

Cost Impact

If there is a cost impact, enter a “Low” and “High” cost. If there is reason for a credible “Most Likely” cost, enter it; otherwise, leave this entry blank. If no cost impact, leave these cells blank.

Time Impact

If there is a time impact, enter a “Low” and “High” time in days. If there is reason for a credible “Most Likely” time, enter it; otherwise, leave this entry blank. If there is no time impact, leave these cells blank.

Rationale Enter the rationale for these assessments.

“Probable Cost” is calculated from the average value of the Probability range multiplied by the average value of the Cost Impact range. “Probable Time” is calculated from the average value of the Probability range multiplied by the average value of the Time Impact range.

Therisksareprioritizedforriskresponseindescendingorderoftheir“ProbableCost”and/or“ProbableTime”.


Producing the Risk Probability Curves 6‐3

Thequantificationsintheriskregistershouldbecombinedtoproduceprobabilitycurvesofthetotalcostoftherisksandthetotaldelaytotheproject.Thisrequiresknowledgeofspecialriskmodelingtoolssuchas@Risk,CrystalBall,orPrimaveraRiskAnalysisforscheduleriskmodeling.Theprojectriskmanagermayperformtheseriskanalysistasks,iftrained,ortheymaybeperformedbyaDepartmentspecialist.TheDistrictRiskManagementCoordinatorcanobtainexpertservicesasneeded.



Cost Risk Curve

TheRiskCost(RC)istheprobabilitydistributionofthetotalcostofallrisksintheprojectriskregister.

Figure3isanexampleofaproject’sRiskCostprobabilitydistribution.

FIGURE 3 – RISK COST PROBABILITY DISTRIBUTION

Thechartshowsthecurvesforthecurrentassessmentandthepreviousassessment,ifavailable.SelectedvaluesofRCat90%,50%,and10%probabilitylevelsaccompanythechart.Fortheexampleabove,thetablewouldindicate:

Current Previous

90% chance RC is greater than $ 144 M $ 164 M



Schedule Risk Analysis

ScheduleriskanalysismaybeperformedusingasimplemodelthatcombinesdelayrisksonthecriticalpathtoRTLandprojectcompletion.Thissimpleversioncanbemodeledusing@Risk.ThisapproachissatisfactoryifaCriticalPathMethod(CPM)scheduleisnotavailable.

IfaCPMscheduleisavailable,thescheduleisimportedintoPrimaveraRiskAnalysis,andthedelayrisksareinserted.Thistoolrunsthesimulationandproducesoutputprobabilitycurvesforselectedmilestones.Expertknowledgeisrequiredtousethistool.ThecurvewilllooksimilartoFigure3exceptthehorizontalaxiswillbeatimescale.

Ifnoneoftheaboveapproachesareavailable,thePRMTcanestimatetheoveralldelaytoRTLandprojectcompletion,andquantifythemintheriskregister.

ThecostofthepotentialdelaytoRTLandprojectcompletion,determinedbyanyoftheabovemethods,shouldbecapturedintheriskregisterastwospecificrisks.



Using the Probability Curves

TheprobabilitydistributionsofcostandschedulemaybeusedbyProjectManagementtoaccomplishthefollowing:

ForaprojectinthePlanningandDesignphase:

Setprojectcostandscheduletargets

Evaluateifcostestimatesandschedulesarerealistic

Evaluatetheadequacyofcontingencyreserves

RequestacontingencyexceedingthestandardCaltransallowance

Evaluatetheprobability(risk)ofexceedingspecificcostandtimetargets

Determinethesensitivityoftheoutputprobabilitydistributiontoinputrisks(RiskSensitivityDiagram),highlightingthemainriskdrivers.

ForaprojectintheConstructionphase:

Performrisk‐basedbudgetanalysesandforecastingcostatcompletion

Assesstheadequacyofremainingcontingency

Requestsupplementalfunds

Evaluatetheprobabilityofmeetingcompletiontargets.



Chapter 7 Risk Response

Riskresponseistheprocessofdevelopingstrategicoptions,anddeterminingactions,toenhanceopportunitiesandreducethreatstotheproject’sobjectives.Aprojectteammemberisassignedtotakeresponsibilityforeachriskresponse.Thisprocessensuresthateachriskrequiringaresponsehasanownermonitoringtheresponses,althoughtheownermaydelegateimplementationofaresponsetosomeoneelse.

Risk Response Strategies 7‐1

For Threats For Opportunities

Avoid.Riskcanbeavoidedbyremovingthecauseoftheriskorexecutingtheprojectinadifferentwaywhilestillaimingtoachieveprojectobjectives.Notallriskscanbeavoidedoreliminated,andforothers,thisapproachmaybetooexpensiveortime‐consuming.However,thisshouldbethefirststrategyconsidered.

Exploit.Theaimistoensurethattheopportunityisrealized.Thisstrategyseekstoeliminatetheuncertaintyassociatedwithaparticularupsideriskbymakingtheopportunitydefinitelyhappen.Exploitisanaggressiveresponsestrategy,bestreservedforthose“goldenopportunities”havinghighprobabilityandimpacts.

Transfer.Transferringriskinvolvesfindinganotherpartywhoiswillingtotakeresponsibilityforitsmanagement,andwhowillbeartheliabilityoftheriskshoulditoccur.Theaimistoensurethattheriskisownedandmanagedbythepartybestabletodealwithiteffectively.Risktransferusuallyinvolvespaymentofapremium,andthecost‐effectivenessofthismustbeconsideredwhendecidingwhethertoadoptatransferstrategy.

Share.Allocateriskownershipofanopportunitytoanotherpartywhoisbestabletomaximizeitsprobabilityofoccurrenceandincreasethepotentialbenefitsifitdoesoccur.Transferringthreatsandsharingopportunitiesaresimilarinthatathirdpartyisused.Thosetowhomthreatsaretransferredtakeontheliabilityandthosetowhomopportunitiesareallocatedshouldbeallowedtoshareinthepotentialbenefits.

Mitigate.Riskmitigationreducestheprobabilityand/orimpactofanadverseriskeventtoanacceptablethreshold.Takingearlyactiontoreducetheprobabilityand/orimpactofariskisoftenmoreeffectivethantryingtorepairthedamageaftertheriskhasoccurred.Riskmitigationmayrequireresourcesortimeandthuspresentsatradeoffbetweendoingnothingversusthecostofmitigatingtherisk.

Enhance.Thisresponseaimstomodifythe“size”ofthepositiverisk.Theopportunityisenhancedbyincreasingitsprobabilityand/orimpact,therebymaximizingbenefitsrealizedfortheproject.Iftheprobabilitycanbeincreasedto100percent,thisiseffectivelyanexploitresponse.

Acceptance.Thisstrategyisadoptedwhenitisnotpossibleorpracticaltorespondtotheriskbytheotherstrategies,oraresponseisnotwarrantedbytheimportanceoftherisk.Whentheprojectmanagerandtheprojectteamdecidetoacceptarisk,theyareagreeingtoaddresstheriskifandwhenitoccurs.Acontingencyplan,workaroundplanand/orcontingencyreservemaybedevelopedforthateventuality.

Mo

nit

ori

ng

& C

on

tro

l

Response

Planning



Examples of Risk Responses

Table 6 repeats the example risk statements from Table 4 and shows a risk response for each.

TABLE 6 –EXAMPLE RISK RESPONSES

Risk Statement Risk Response

Design

Inaccuraciesorincompleteinformationinthesurveyfilecouldleadtoreworkofthedesign.

Mitigate:WorkwithSurveystoverifythatthesurveyfileisaccurateandcomplete.Performadditionalsurveysasneeded.

AdesignchangethatisoutsideoftheparameterscontemplatedintheEnvironmentalDocumenttriggersasupplementalEIRwhichcausesadelayduetothepubliccommentperiod.

Avoid:MonitordesignchangesagainstEDtoavoidreassessmentofEDunlesstheopportunityoutweighsthethreat.

Environmental

Potentiallawsuitsmaychallengetheenvironmentalreport,delayingthestartofconstructionorthreateninglossoffunding.

Mitigate:Addressconcernsofstakeholdersandpublicduringenvironmentalprocess.Scheduleadditionalpublicoutreach.

Nestingbirds,protectedfromharassmentundertheMigratoryBirdTreatyAct,maydelayconstructionduringthenestingseason.

Mitigate:Schedulecontractworktoavoidthenestingseasonorremovenestinghabitatbeforestartingwork.

R/W

Duetothecomplexnatureofthestaging,additionalrightofwayorconstructioneasementsmayberequiredtocompletetheworkascontemplated,resultinginadditionalcosttotheproject.

Mitigate:Re‐sequencetheworktoenableROWCertification.

Duetothelargenumberofparcelsandbusinesses,thecondemnationprocessmayhavetobeusedtoacquireR/W,whichcoulddelaystartofconstructionbyuptooneyear,increasingconstructioncostsandextendingthetimeforCOS.

Mitigate:WorkwithRight‐of‐WayandProjectManagementtoprioritizeworkandsecureadditionalright‐of‐wayresourcestoreduceimpact.

Construction

Hazardousmaterialsencounteredduringconstructionwillrequireanon‐sitestorageareaandpotentialadditionalcoststodispose.

Accept:Ensurestoragespacewillbeavailable.

Unanticipatedburiedman‐madeobjectsuncoveredduringconstructionrequireremovalanddisposalresultinginadditionalcosts.

Accept:IncludeaSupplementalWorkitemtocoverthisrisk.



Responding to Risks

Followingidentificationandanalysisofprojectrisks,thePRMTtakesactioninresponsetotheriskstoimprovetheoddsinfavorofprojectsuccess.Ultimately,itisnotpossibletoeliminateallthreatsortakeadvantageofallopportunities–buttheywillbedocumentedtoprovideawarenessthattheyexistandhavebeenidentified.Successfulriskresponsewillchangetheriskprofilethroughtheprojectlifecycle,andriskexposurewilldiminish.

Riskresponseinvolves:

ThePRMTdeterminingwhichriskswarrantaresponseandidentifyingwhichstrategyisbestforeachrisk.

AssigninganactiontotheRiskOwnertoidentifyoptionsforreducingtheprobabilityorimpactsofeachrisk.TheRiskOwnertakestheleadandcaninvolveexpertsavailabletotheproject.

Evaluatingeachoptionforpotentialreductionintheriskandcostofimplementingtheoption.

Selectingthebestoptionfortheproject.

Requestingadditionalcontingency,ifneeded(forguidance,refertoAppendix“A”ofProjectDeliveryDirectivePD‐04“ProjectContingenciesandSupplementalWork”).

AssigninganactiontotheRiskOwnertoexecutetheselectedresponseaction.TheRiskOwneristheleadandmayassignspecifictaskstootherresourcestohavetheresponseimplementedanddocumented.

IfthePRMTjudgesthatariskshouldbeaccepted,itmayassignanactiontotheRiskOwnertoprepareacontingencyplanifdeemednecessary.

A RISK PERSPECTIVE CAN ENHANCE DECISIONS

Whenconsideringriskmitigationmethodology,itisimportanttorecognizetheimpactsofthedecision.Theimpactofrespondingtoariskmaymakesenseintheshortterm(e.g.Savesdesigncosts,allowsteamtomeetschedule),buttheimpactoftheriskneedstobetakenasawhole.

Forexample,theimpactofjustafewunknownconditionscanaffecttheconstructionscheduletothepointwhereanenvironmentalworkwindowrequirestheprojecttobesuspended.Itisimportanttorecognizehowmuchofanimpacttherewouldbeinmakingadecision.Whilethedirectcostofresolvingtheunknownconditionmaybelessthanthecostofasitevisit,theoverallimpactofthechangemaybeasignificantdelaytothecontractifnotrecognized.

Entering Risk Responses into the Risk Register 7‐4

Theriskresponseactionforeachriskisenteredintothe“ResponseActions”columnoftheriskregister.



Chapter 8 Risk Monitoring

Continuousmonitoringbytheprojectriskmanagerandtheprojectteamensuresthatnewandchangingrisksaredetectedandmanagedandthatriskresponseactionsareimplementedandeffective.Riskmonitoringcontinuesforthelifeoftheproject.

Riskmonitoringandcontrolkeepstrackoftheidentifiedrisks,residualrisks,andnewrisks.Italsomonitorstheexecutionofplannedstrategiesfortheidentifiedrisksandevaluatestheireffectiveness.

Riskmonitoringandcontrolcontinuesforthelifeoftheproject.Thelistofprojectriskschangesastheprojectmatures,newrisksdevelop,oranticipatedrisksdisappear.Riskratingsandprioritizationscanalsochangeduringtheprojectlifecycle.

Typically,duringprojectexecution,riskmeetingsshouldbeheldregularlytoupdatethestatusofrisksintheriskregister,andaddnewrisks.Periodicprojectriskreviewsrepeattheprocessofidentification,analysis,andresponseplanning.

Ifanunanticipatedriskemerges,orarisk’simpactisgreaterthanexpected,theplannedresponsemaynotbeadequate.TheprojectmanagerandthePRMTshouldperformadditionalresponsestocontroltherisk.

Monitoringalsodetermineswhether:

ThePRMTisperformingperiodicriskreviewandupdating

Riskmanagementpoliciesandproceduresarebeingfollowed

Theremainingcontingencyreservesforcostandscheduleareadequate

Anditmayinvolverecommending:

Alternativeriskresponses

Implementingacontingencyplan

Takingcorrectiveactions

Changingtheprojectobjectives

Risk Review and Updating 1‐1

Periodically,thePRMTwillconvenetoreviewtheproject’sriskregisterandriskresponseactions,andtoupdateprojectriskinformation.

Beforeupdatingtheregisterandrecordingchanges,theprojectriskmanagershouldmakeacopyoftheriskregisterfortheprojectfiles,notingitsdatadate.Thesetofriskregisterswilldocumenthowriskshavechangedoverthelifeoftheprojectandprovideanaudittrailshoulditberequired.

Mo

nit

ori

ng

& C

on

tro

l

Response

Planning



ThereviewtasksofthePRMTincludethefollowing:

Identify,analyze,andplanresponseactionsfornewlyarisingrisks,andaddthemtotheriskregister.

Reviewtheexecutionofriskresponseactions,andevaluatetheireffectiveness.

Re‐assessexistingrisks,verifythattheassumptionsarestillvalid,andmodifythepreviousassessmentsasnecessary.

AssignadditionalriskresponseactionstotheRiskOwner.

Retireriskswhoseopportunitytoimpacttheprojecthaselapsed,orwhoseresidualimpactontheprojectisdeemedtohavereachedanacceptablelevel.

ThePRMTshoulddiscussanyrisksforwhichresponseactionsarenotbeingcarriedouteffectivelyorwhoseriskimpactisincreasing.IfthesecannotberesolvedwithinthePRMT,theyshouldbeescalatedtotheprojectmanagerwithrecommendationsforaction.

Updating the Risk Register 1‐2

Makeanychangesandadditionstotherisksandentertherevisiondateintothe“Updated”column.

Lessons Learned 1‐3

Whenariskisretired,thePRMTwillreviewthehistoryoftherisktorecordanylessonslearnedregardingtheriskmanagementprocessesused.Theteamisessentiallyaskingitself:“What,ifanything,wouldwehavedonedifferentlyandwhy?”

TheprojectriskmanagerwillconductaperiodicreviewofalllessonslearnedwiththePRMT.



Chapter 2 Communication and Accountability

Communicationandconsultationwithprojectstakeholdersandsponsorsarecrucialfactorsinundertakinggoodriskmanagementandinachievingprojectoutcomesthatarebroadlyaccepted.Thishelpseveryonetounderstandtherisksandtrade‐offsthatmustbemadeinaprojectandsupportstheprojectmanager’sefforts.

Regularreportingisanimportantcomponentofcommunication.Reportsonthecurrentstatusofrisksandriskmanagementensurethatallpartiesarefullyinformedandunderstandtherisks,thusavoidingunpleasantsurprises.

Theprojectriskmanagerwillensurethattheriskmanagementprocessisdocumentedtoensureaclearaudittrail.

RE‐FILE HAND‐OFF – A VITAL COMMUNICATION

Communicationisimportantinriskmanagement.Resolvinguncertaintiesiseasierandhaslessimpactthanresolvingsurpriseslater.Adiscussionoftheprojectbetweenthedesignteamsandtheconstructionteamsisimperativeinthesuccessfulmanagementofriskinaconstructionproject.Itisimportantthatbothteamsagreeonwhatriskremainsandcommittomanagingitthroughouttheproject.

AprojectinDistrict4wasonanaccelerateddeliveryschedule.DiscussionsbetweenDesignandConstructionidentifiedseveralissuesthatneededtobeaddressed.MostofthisinformationwasprovidedintheREPendingfileinsomeform,buttheconstructionteamcouldnotprioritizetheireffortswithoutdetaileddiscussionswithDesign.

Communication and Accountability Checkpoints 2‐1

Therearethreekindsofcheckpoints:

Communication–Wherethecurrentriskregisteriscommunicatedtostakeholders,sponsors,andteammemberstomakethemawareofthecurrentstatusofrisks.

Accountability–Wherethedeputiessignoffontherisks,indicatingthattheyhavereviewedtherisksdocumentedintheriskregisterandagreethattheyhavebeenmanagedtotheextentpossiblebythePRMT.

PerformanceMeasure–WheretheDESOEvalidatestherequiredsignaturesanddatesoftheaccountabilitycheckpointsbeforeRTL.

Mo

nit

ori

ng

& C

on

tro

l

Response

Planning



Figure4showsthecheckpointsduringthephasesofaproject’slifecycle.Communicationcheckpointsareshadedgrayandrequiredaccountabilitycheckpointsareinred.PIDApprovalandREFileHandoffarerecommendedaccountabilitycheckpoints.

Project Phase

Checkpoint No.

Deliverable or Communication Checkpoint

PID 1 PID [RecommendedAccountabilityCheckpoint]

PA&ED 23

DraftProjectReport(DPR)ProjectReport(PR) [RequiredAccountabilityCheckpoint]

PS&E

4444567

30%ConstructabilityReview(CR)TypeSelection60%ConstructabilityReview(CR)90%ConstructabilityReview(CR)FoundationReportApproved(FR)PS&EtoDES‐OE [RequiredAccountabilityCheckpoint]PerformanceMeasure

R/W 8910

BetweenM225(RegularR/W) andM410(R/WCert)BetweenM410&M412(AdvertiseandAward)ApprovedUtilityRelocationPlanapproval

Construction

1112131415

REFileHandoff [Recommended AccountabilityCheckpoint]BetweenM500(ApproveContract)andM600(ContractAcceptance)CCOsNOPCsSupplementalFundRequest&G12’s(SFR)

FIGURE 4 – COMMUNICATION AND ACCOUNTABILITY CHECKPOINTS



What Happens at a Communication Checkpoint 2‐2

Thecurrentprojectriskregisterissubmittedbytheprojectmanagerateachcheckpoint.TheriskregisterwithacoversheetwillserveastheriskcommunicationmediumforLevel1andLevel2projects.Thecoversheetshouldsummarizethechangestotheriskregistersincethepreviouscommunication,suchas:

Changesinriskpriorities,

Risksthathavebeenretired,

Newrisksidentified,and

Riskresponseactionsthathavebeencompleted.

Level3projectswillrequireamoredetailedreportthatincludestheprobabilitycurvesandtheirrelationtoprojectobjectivesandtheriskoutlookuntilthenextreviewperiod.

What Happens at an Accountability Checkpoint 2‐3

Theprojectmanagerwillschedulethemeeting,ortheSingleFocalPointcanarrangeformultipleprojectstobediscussedinonemeeting.ThegoalisforthedeputiestoreviewtheprojectanditsriskstoensurethatthePRMThasmanagedtherisksacceptably.

TheprojectmanagerwillcreateaRiskRegisterCertificationFormtobringtotheaccountabilitycheckpointmeetingsforsignaturebythedeputies.ThesignedformiskeptintheprojectfilesforuseateachaccountabilitycheckpointandissubmittedtotheDES‐OEattheperformancemeasurecheckpoint.TheformisshowninAppendixB,andmaybedownloadedfrom:http://onramp/riskmanagement.

What Happens at the Performance Measure Checkpoint 2‐4

TheDesignthroughConstructionSubcommittee'sPerformanceMeasuresTaskGroupdevelopedaPerformanceMeasureforRiskManagement.ItrequiresthatatRTL,theDES‐OEwillvalidatethedatesandsignaturesontheRiskRegisterCertificationFormoftheproject.



ACRONYMS AND DEFINITIONS Appendix A

ACRONYMS

CCA Construction Contract Acceptance

CCO Contract Change Order

CCPSC Caltrans Construction Partnering Steering Committee

CPM Critical Path Method

CR Constructability Review

DES Division of Engineering Services

DOE District Office Engineer

DPR Draft Project Report

DRL Dispute Resolution Ladder

EIR Environmental Impact Report

EIS Environmental Impact Study

ERM Enterprise Risk Management

G12 General Delegation 12

HQ Headquarters

NOPC Notice of Potential Claim

OE Office Engineer

PCR Project Change Request

PDD Project Delivery Directive

PDT Project Development Team

PID Project Initiation Document

PM Project Manager

PMBOK Project Management Body of Knowledge

PR Project Report

PRM Project Risk Manager

PRMT Project Risk Management Team

PSR Project Study Report

PA & ED Project Approval and Environmental Document

PS & E Plans, Specifications, and Estimates

RC Risk Cost

RE Resident Engineer

RMP Risk Management Plan

R/W Right of Way

RTL Ready to List

SFP Single Focal Point (PM District Deputy Director)

SFR Supplemental Funds Report

TRO Time Related Overhead



DEFINITIONS

Accountability Checkpoint

Pointsintimeduringtheprojectlifecyclewhereaformalsign‐offwilloccur.Sign‐offsignifiesthatthereisanunderstandingandacceptanceoftherisksmovingforwardintothenextphaseoftheproject.

Communication Checkpoint Apointintheprojectlifecyclewhererisksarecommunicatedtostakeholders,sponsors,andteammembers.

Dispute Resolution Ladder Outlineswhenandhowadisputewillbeelevatedandsubsequentlyresolved.

Enterprise Risk Management Themethodsandprocessesusedbyorganizationstomanagerisks,identifythreats,andseizeopportunitiesrelatedtotheachievementoftheirobjectives.

Project Life Cycle Allphasesofprojectdeliveryfromprojectinitiationtoprojectclose‐out.

Project Objectives Theagreed‐upondeliverytargets, suchascost,time,scope, orquality.

Project Risk Anuncertaineventorconditionthat,ifitoccurs,hasapositiveoranegativeeffectonatleastoneprojectobjective.

Project Risk Management Aprocessforidentifying,communicating,andmanagingprojectrisksthroughallphasesofprojectdelivery.

Project Risk Manager Facilitatestheriskmanagementprocessandactsasgatekeeperfortheriskregister.

Qualitative Risk Analysis Theprocessofprioritizingrisks.

Quantitative Risk Analysis Theprocessofprobabilistically analyzingthecostandtimeeffectsofidentifiedrisksonoverallprojectobjectives.

Risk Anuncertaineventorconditionthat,ifitoccurs,hasanegativeorpositiveeffectonatleastoneprojectobjective.

Risk Cost Theprobabilitydistributionofthetotalcostofallrisksintheprojectriskregister.

Risk Management Performance Measure

AcheckpointwheretheSPFreviews eachprojectandits riskstoensurethatthePDThasadequatelyrespondedtothehighestpriorityrisks.

Risk Owner AmemberofthePRMTtowhichtheriskisassigned.

Risk Register Adocument(typicallyaspreadsheet)thatcontainstheresultsofaqualitativeriskanalysisand/oraquantitativeriskanalysisandariskresponse.

Risk Response Actionstakentoenhanceopportunitiesandreducethreatstotheachievementofprojectobjectives.

Scalable Approach Providestheminimumlevelofeffortofprojectriskmanagementthatisappropriatetoaparticularprojectdependingonitssizeandcomplexity.

Time Related Overhead Overheadcostsprimarilyproportionaltothetimetoperformwork.

Time Related Overhead Plus Thedirectcostsassociatedwithtime.



RISK MANAGEMENT PLAN TEMPLATE Appendix B

Downloadthistemplatefrom:http://onramp/riskmanagement.



RISK REGISTER CERTIFICATION FORM Appendix C

Downloadthisformfrom:http://onramp/riskmanagement.



PD‐09 PROJECT RISK MANAGEMENT Appendix D

Downloadthedirectivefrom:http://onramp/riskmanagement.



PROJECT RISK MANAGEMENT STRUCTURE Appendix E

Project Risk Management Elements

Projectriskmanagementincludesthefollowingprogramelements.EachelementisimportanttodevelopingeffectiveprojectriskmanagementonCaltransprojects.

Ascalableprojectriskmanagementprocess‐threelevelsofeffortbasedonthesizeandcomplexityoftheproject

Clearcommunicationandaccountabilitycheckpointssothatprojectdeliveryisseenasoneprocessacrossmultiplefunctions

Anewupdated“how‐to”stylehandbook

IncorporationofprojectriskmanagementintotheexistingFunctionalUnits’guidance

ProjectDeliveryDirective(PD‐09)andpoliciesforimplementation

TrainingandsubjectmatterexpertsfromHeadquartersandDistricts

Project Risk Management Overview



FIGURE 5 – CALTRANS PROJECT RISK MANAGEMENT

Figure5isanoverviewoftheProjectRiskManagementstructure.Itisdividedintotwolevels:CorporateandProject.

Corporate Level

ThecorporatelevelillustrateshowprojectriskmanagementisoverseenbytheProjectDeliveryBoard,astheyareresponsibleforthesuccessfuldeliveryofprojects.TheProjectDeliveryBoardandtheChiefEngineerhavedevelopedPD‐09astheirprojectriskmanagementpolicythatistobecarriedout.AllGuidanceforProjectDeliveryFunctionsareexpectedtoincorporatetheprojectriskmanagementpoliciesandrequirementsasoutlinedinthishandbook.Traininginprojectriskmanagementwillbedevelopedandmadeavailabletoallofthoseaffectedbythenewrequirements.

TheProjectManagementDivisionisresponsibleforfacilitatingtheriskmanagementprocessandensuringthatrisksaremanagedonprojects.ProjectManagementDivisionisresponsibleforprovidingHeadquartersProjectRiskManagementCoordination(expertise)toprojectsandDistrictProjectRiskManagementCoordinators.



Project Level

EachDistrictwillprovideriskmanagementexpertisethroughaDistrictRiskManagementCoordinatorwhowillassistprojectteamsintheimplementationoftheprojectriskmanagementprocess.Attheinceptionofriskmanagementforaproject,theprojectteamwilldeterminetheproject’sscalabilitylevelasLevel1,2,or3.TherequirementsforeachlevelarepresentedinChapter1,Section1‐4.

TheprojectmanagerfacilitatesthedevelopmentandmanagementofariskregisterfromPlanningandDesignphasesthroughtheConstructionphase.Thegrayboxesonthechartindicatewherethecommunicationpointsaretooccur.Theredboxesareaccountabilitycheckpointswhereaformalsign‐offmustoccur.ThegreenboxindicateswheretheDesignthroughConstructionPerformanceMeasurewilloccur.Thismeasureensuresthattheprojectriskmanagementprocesshasbeenfollowedfortheproject.

Projectmanagersarenotexpectedtoidentifyalloftherisksbythemselves.TheProjectRiskManagementTeam(comprisedofmembersofthePDT)willworktogethertoidentifytheprojectrisks,populatetheriskregister,andmanagetherisksuntilcompletionofconstruction.Managingrisksinaworkshopenvironmentwillensurethatallmembersoftheteamunderstandtherisksandtheirpotentialimpactontheirfunctionalareas.

TheProjectRiskManagementTeamisexpectedtostaytogethertomanagerisksuntilprojectcompletion.



ACKNOWLEDGEMENTS Appendix F

RISK MANAGEMENT TASK GROUP

TheDesign‐ConstructionStrategicPartneringSubcommitteeaskedtheRiskManagementTaskGrouptodevelopaneffectiveProjectRiskManagementprocessforCaltransprojects.

Task Group Co‐Chairs:

JonTapping–TollBridgeProgram,RiskManagementRobStott–DESStructureConstruction

Task Group Members:

ElizabethDooher–PartneringProgramManagerFarhadFarazmand–D‐4ConstructionRichFoley–RiskManagerwithTollProgramAnupKhant–HQProjectManagementDivisionRobertoLacalle–DES,ProjectManagementReinLemberg–CALTROPCorporationEdmondMatevosian–ProjectManagement,RiskManagementKenSolak–HQConstruction,PartneringCoordinatorRonTsung–D‐4DesignJackYoung–DES,StructureOEDaveYoumans–ProjectManagement

Facilitator:

SueDyer‐OrgMetrics

Sponsors:

MarkLeja,ChiefofDivisionofConstructionTerryAbbott,ChiefofDivisionofDesignJimDavis,ActingChiefofDivisionofEngineeringServicesBobPieplow,ChiefofDivisionofEngineeringServices



DESIGN THROUGH CONSTRUCTION SUBCOMMITTEE

TheDesignthroughConstructionSubcommitteeisapartoftheCaltransConstructionPartneringSteeringCommittee(CCPSC).TheCCPSCisaCaltransandIndustrygroupworkingtodevelopacultureofpartnershiponprojectsthroughouttheprojectlifecycle.TheDesignthroughConstructionSubcommitteehastakenonDesignthroughConstructionPerformanceMeasures;ProjectRiskManagement,andwillsoonstartCapturingLessonsLearnedandPDTTeameffectivenessandPartnering.

Subcommittee Co‐Chairs:

TerryAbbott,ChiefofDivisionofDesignMarkLeja,ChiefofDivisionofConstructionBobPieplow,ChiefofDivisionofEngineeringServicesKarlaSutliff,ChiefofDivisionofProjectManagement

Caltrans Construction Members:

RobEffinger(Acting)–DivisionofConstruction,AssistantChiefElizabethDooher–DivisionofConstruction,PartneringProgramManagerJohnRodrigues–NorthRegionConstructionRegionalDivisionChiefMarkDerMatoian–CentralRegionConstructionRegionalDivisionChiefRoyFisher–District7ConstructionDeputy

Caltrans Design Members:

TimCraggs–DivisionofDesign,AssistantChiefLenkaCulik‐Caro–District4DesignDeputyBillReagan–District7DesignDeputyGaryVettese–District11DesignDeputy

Caltrans Engineering Services (Structures) Members:

JohnMcMillan–DivisionofEngineeringServices,OfficeEngineerDeputyKevinThompson–DivisionofEngineeringServices,StructureDesignDeputyRobStott–DivisionofEngineeringServices,StructureConstructionDeputy

Facilitator:

SueDyer–OrgMetrics

Sponsor:

RichardLand,ProjectDeliveryDeputyDirectorandChiefEngineer

project risk management handbook: a scalable approach

Documents