project risk management -...

6th African Rift Geothermal Conference | ARGeo-C6 Short Course 1 | Project Management for Geothermal Development

Project risk management

Carine Chatenay, Verkís

ARGeo-C6 Short Course 1 | Geothermal Project Management Addis Ababa, Ethiopia | 31 Oct – 1 Nov, 2016

Learning outcome

• How to develop risk management culture in the project

• Ways to implement risk management

• Risk management principles and structure


Content

• Risk culture

• Management principles

• Roles and responsibilities

• Monitoring and review

• Risk assessment: • Process

• Assessment methods

• Risk ranking

• Tips


Risk culture What is risk management


What is risk


What is risk?

Source: http://intelmsl.com/insights/intelligence-101/threat-and-risk/


Various concepts

• Danger, hazard

• Occurence

• Probability

• Uncertainty

• Opportunity vs. threat


A definition of risk

Risk is the effect of uncertainty on objectives (from ISO 31000 – „Risk management – Principles and guidelines“)

Can be negative: threat

Or positive: opportunity


Other definitions

“combination of the probability of occurrence of harm and the severity of that harm” NORSOK Z-013

“an uncertain event or condition that, if it occurs, has a positive or negative impact on project‘s objectives“ PMBok

Source:http://financetrainingcourse.com/education/2012/12/what-is-risk-the-new-risk-assessment-risk-management-training-series/


Risk management process

• Identify and characterize threats

• Assess the vulnerability of critical assets to specific threats

• Determine the risk (expected likelihood and consequences of specific attacs on specific assets)

• Identify ways to reduce risk

• Prioritize risk reduction measures based on strategy


Risk management culture

Why develop an effective risk management culture? • Creating and protecting of value

• Part of decision making and of all processes

• Addresses uncertainties in a systematic, structured and manner

• Examples: Maersk


Risk management principles How is risk management implemented?


Risk management principles

• Tailorable

• Protect everything of value

• Takes into account the internal context (organization...)

• Systematic and structured

• Part of decision making

• Transparent, dynamic, iterative, etc..



1. Communication and consultation

2. Establish the context

3. Risk assessment

4. Risk treatment

5. Monitoring and review


Risk management framework

• Define roles & responsibilities, plans, objectives, methods and implement risk management activities accordingly.

Plan

Do Check

Act


Building capacity and competence

• At organization level, but also at project level

• Select people with skills and knowledge

• Get managements support


Roles and responsibilities Who are the players?

• 3.


At organization level

• Senior management responsibilities

• The role of individuals


In a project - Who is in charge?

• Project manager

• Risk champion (if required)

• Risk owners

• Action owners


Communication and consultation

• Communication = key element

• Ongoing process

• Build positive attitude


Process How is risk assessment conducted?



2. Establishing the context

3. Risk assessment

3.1 Risk identification

3.2 Risk analysis

3.3 Risk evaluation

4. Risk treatment




Typical fields of application

• Project risk management

• Cost and schedule risk managment

• Technical risk management

• Health, safety and environment risk management

• Procurement, ...


Make a risk management plan

• Highly recommended from the beginning: used to define the risk management framework and outline risk activities required.

• Typical content: • Risk management methodology;

• Roles and responsibilities and relevant authority level;

• Budgeting;

• Planning;

• Risk evaluation scheme;

• Documentation and reporting requirements.


Typical activities to plan

• Project risk

• Technical risk assessment

• Risks during construction

Field of application

Project Project

risks

Project

risks

Project risks 1

Project risks2

Cost and schedule

Cost and schedule risk assessment

Cost and schedule risk assessment

Cost and schedule

risks3

Technical

Preliminary Hazard

Analysis4

Preliminary HazOp5

HazOp6

HazOp update7

Construction hazard study8

HSE

Specific HSE risk

studies

Specific HSE risk

studies

JSEA and “on the go”

assessments

Root Cause

analysis

Procurement Packages procurement

risk strategy

Contractors risk

1 Regular update if required 2 Quarterly update or upon achievement of major milestone 3 Regular update 4 Or similar, includes safe in design aspects 5 Or similar, includes safe in design aspect. Encompasses other specific risk studies, e.g. fire... 6 Or similar. Other specific risk studies. Updates in case of scope or design modifications 7 Update before POV to ensure the system is designed and installed 8 Regular update as required.

Pre-feasibility Feasibility Detail design EXECUTION


Players & roles

• Project manager • Responsible for risk management: makes sure it is implemented • Overall owner of the risk register

• Risk study leader / risk analyst • Project manager for individual risk assessment study • Facilitates the risk assessment process

• Workshop (risk assessment) participants • Provide input and contribute to the risk assessment

• Risk owners • Responsible for ensuring that a risk is managed

• Action owners • Allocated specific tasks to manage the risk


1. Communication & consultation


3. Risk assessment


3.2 Risk analysis

3.3 Risk evaluation

4. Risk treatment




1. Communication & consultation

• Communication and consultation is a key element of the risk management process

• To be used as relevant at each stage of the risk management process

• In accordance with the project communication plan or principles.




3. Risk assessment


3.2 Risk analysis

3.3 Risk evaluation

4. Risk treatment




Tip: initiate a risk study

• What for? • Determine exact scope of the risk study (components, limits, extent of the

study)

• Identify stakeholders

• Determine consultation and communication requirements

• Who is involved in initiation? • Project manager

• Risk facilitator or risk study leader



• Understand the background of the study: • Objectives of the study;

• Identifying the internal and external environment of the study;

• Specifying the scope and objectives of the study;

• Specifying the boundaries of the study;

• Determining the criteria against which the risks are to be evaluated;

• Defining the key elements of the study.


Context

• External context: • Social, cultural, political, legal, regulatory, financial, technological, economic,

natural... • Key drivers • External stakeholders

• Internal context: • Governance, organizational structure,... • Policies, objectives • Resources: capital, time, people, technologies • Organization‘s culture...


Context tool example: PESTLE

Project

Political factors

Environ-mental factors

Social factors

Technological factors

Economic factors

Legal factors


3. Risk assessment


3. Risk assessment


3.2 Risk analysis

3.3 Risk evaluation

4. Risk treatment




3. Risk assessment

• Risk is generally associated with the following components: • A source of risk or hazard;

• An event or incident;

• A cause for the presence of the hazard or for the event to occur;

• A location where the hazard (where) or event takes place and a given moment (when);

• A consequence, outcome or impact;

• Controls to prevent the risk from happening, characterized by a given level of effectiveness or adequacy to control the risk.


3.1. Risk identification

Risk identification consists in 1. identifying first what can happen?

2. where ?

3. and when?

It is then necessary to identify the possible causes and scenarios by asking

1. “why?”

2. and “how?” to ensure no significant causes are omitted.


3.2. Risk analysis

• Risk analysis involves • developing understanding of the existing controls and

• determining consequences, likelihood and hence the level of risk.

• Scenarios of the most serious credible consequence are identified in order to capture all potential consequences of the risk.


Types of analysis

• Quantitative analysis

• Semi-quantitative analysis

• Quantitiavite analysis


3.3. Risk evaluation

• Risk evaluation is aimed at assisting the decision making process in determining the need for risk treatment and priority for treatment implementation.


4. Risk treatment


3. Risk assessment


3.2 Risk analysis

3.3 Risk evaluation

4. Risk treatment




4. Risk treatment

• Risk treatment consists in identifying and selecting the options for treating risks and implementing them.

• Decisions on risk treatment may be based on a cost-benefit analysis and are taken in cooperation with the Risk Study Owner.


Risk treatment decision

• Retain: accept the risk, do nothing about it

• Reduct: of probability and/or impact

• Avoidance: no performing the activity that implies the risk (NB: may lead to other risks)

• Transfer: pass on to another party (e.g. Insurance, contract...)


Risk treatment consideration

• Avoid the risk by deciding not to start the activity that gives rise to the risk; • Seek an opportunity by deciding to start or continue with an activity likely

to create or enhance the risk; • Remove the source of a threat; • Change the nature and/or magnitude of likelihood; • Reduce the consequences of a threat; • Enhance the gain from an opportunity; • Change both likelihood and consequences of a risk; • Accept the risk and develop suitable contingency plans; • Monitor the causes of the risk and develop response plans for when it

occurs.

• 1. Process


The ALRAP, or ALARA, concept

Ris

k in

crea

sin

g

Intolerable region – risk cannot be justified

Tolerable only if risk reduction is impractical

or if cost is grossly disproportionate to the

benefits gained

Acceptable risk, no need for

ALARP


Cost/benefit of risk mitigations

Source: http://www.jakeman.com.au/media/alarp-as-low-as-reasonably-practicable


HSE: hierarchy of control

Elimination

Substitution

Engineering controls

Administrative controls

PPE

Most effective

Least effective

Physically remove the hazard

Replace the hazard

Isolate people from the hazard

Change the way people work

Protect worker with Personal Protective Equipment


Risk treatment plan – key issues

• Details to be recorded: • What is the risk treatment? if needed detailed actions? • Who is responsible for follow-up (risk owner)? • By when it is to be completed? • Monitoring if needed?

• Validation at the right level • Project manager of if needed higher level

• Ownership • Inform the risk owner; make sure communication is in place

• Follow-up plan:


5. Follow-up, report & monitoring


3. Risk assessment


3.2 Risk analysis

3.3 Risk evaluation

4. Risk treatment




5. Follow-up, report & monitoring

• Why? • For transparency purposes, to demonstrate to relevant stakeholders how the

risk management process has been conducted;

• To provide evidence of a systematic approach to risk assessment;

• To provide record of risks and develop a database for the purpose of learning lessons;

• To keep track of the decision taken concerning the risks identified and provide a framework for continuing monitoring and review;

• To satisfy audit requirements;

• To share information & provide support to communication on risk.


Monitor, review and continuous improvement

• Monitor and review

• Learn from risk events • What happened

• How and why?

• Likelihood of the event happening again

• Review of the risk treatment approach

• Communication aspects


Recording

• Documents to be considered for record:

• Risk management plan

• Risk registers

• Risk study report

• Incident database


Risk register sample – Project risks

Risk identification Risk analysis Risk treatment Monitoring

Risk # Risk title Cause Consequence Risk Risk treatment Risk owner Monitoring Due date Risk Progress Status Initial Rev.

cu

rren

t

Monitoring

plan:

milestone

and report targ

et

sessio

n

sessio

n

ID Impact of summer

vacation on the

project milestones

Project staff

summer vacation

not appropriately

taken into account

in the schedule

Delay on project

milestones up to

1 month.

IV Coordinate project

activities and planned

summer vacation to

ensure project progress

as planned. Plan for

back-up staff to reinforce

the team if required.

xxx, Project

manager

at 80%

completion

of the risk

treatment

plan

05.07.15 III Plan not

approved

Draft 1

ID


Risk assessment methods What methods are available?


Assessment technique selection

Selection based on:

• Complexity of the problem

• Information available

• Resources required: time, level of expertise,...

• Desired output (qualitative, quantitative?)


Selection – Methods attributes

Method Risk assessment technique

Look-up methods Check-lists; preliminary hazard analysis

Supporting methods Structured interview; brainstorming; Delphi, SWIFT; human reliability analysis

Scenario analysis Root cause analysis; toxilogical risk assessment; business impact analysis; fault-tree analysis; event-tree analysis; cause/consequence analysis; cause and effect analysis;

Function analysis FMEA/FMECA; reliability; sneak analysis; HazOp; HACCP

Controls assessment LOPA (Layers of protection) analysis; bow tie analysis

Statistical analysis Markov analysis; monte-carlo analysis; bayesian analysis


Preliminary hazard identification

Overview Identification of hazards

Use Early stage of project development or as a preliminary study for prioritizing further analysis

Inputs

Process List of hazard or generic hazardous situations is formulated Qualitative analysis sometimes used to analyze the risks

Output List of hazards Recommendations

Pros Practical when information is limited Simple approach

Cons Only preliminary, not comprehensive


Brainstorm

Overview Free-flowing conversation aimed at identifying potential risks.

Use At any stage

Inputs Knowledgeable people, key stakeholders

Process Structured or not. May be facilitated by someone starting off discussion or prompting the group

Output e.g. List of risk

Pros Involvement of key stakeholders Quick and easy

Cons Lack of structure, highly dependent on the group dynamic


SWIFT

Overview Structured What If Analysis - Alternative to HazOp. Systematic study using prompts words or phrases

Use For systems, plants procedures...

Inputs Description of the system studied: split into nodes, context

Process Use of prompt list „What if...“ apllied systematically to each node of the system. Risk identified assessed and evaluated.

Output Risk register

Pros Rather simple and rapid, systematic Involvement of key players

Cons Experienced and capable facilitator needed Could become time consuming in not managed carefully May be too shallow, complex issues not revealed


Scenario analysis

Overview Development of models on how the future may turn out

Use Policy making, planning strategies, consider existing activities

Inputs Team of people, brainstorm

Process Consider changes and various factors and develop scenarios

Output Described scenarios and range of options, how to modify the course of actions

Pros Interesting for risks considered in the long term

Cons Uncertainty, unrealistic scenarios


Take 5 – a short job risk assessment

Take 5 – is a short and simple risk assessment to be performed by workers before they start on a task. The main issues are: 1. Mind the task:

What is it I am supposed to do, with whom, where are the dangers, where is it to be performed, do I need a permit, do I have all necessary equipment, etc.

2. Analyse and assess Is there a risk, what risk is it, how great is it, is it acceptable ? A threat to life – Dangerous – accidents possible – Under control

3. Control the risk What can be done about the risk ? Can it be removed or reduced ? What means are available for that purpose ?

4. Proceed with work in a safe way Use the means found to control the risk and work in a safe way

If the risk is unacceptable and it is neither possible to remove it nor reduce it:

Notify your foreman and do not commence with the task !


Risk ranking


What is risk?

“effect of uncertainties on objectives” ISO 31000:2009

“combination of the probability of occurrence of harm and the severity of that harm” NORSOK Z-013

“an uncertain event or condition that, if it occurs, has a positive or negative impact on project‘s objectives“ PMBok


Risk categories

• Typical categories: • Health and safety

• Environment

• Capital cost

• Schedule

• Operation (increased cost)

• Production (loss)

• Maintenance (increased cost)

• Image

• ...


Rating

• Consequence category

• Probability / frequency

• Number of persons concerned: sometimes used for a quantitative or semi-quantitative assessment

• Control: sometimes used to assess if the controls in place address the risk adequately


Consequence rating - example

Source: http://www.marchmenthill.com/uploads/126-QSI-6-Water-FINAL-Article-Investment-Justification-Fig-2-crop.JPG


Probability/frequency rating example

Very Unlikely Unlikely Probable Highly Likely

Frequency Interval

(Multiple events)

Almost Impossible

<1/10 years

Possible Sometime

1/year – 1/10 years

Isolated Incidents

2/year – 1/year

Repeated Incidents

>2/year

Probability

(Single events)< 1% 1% - 10% 10% - 25% > 25%

Likelihood

Category

Probability

Frequency

D

Unlikely

E

Improbable

More than 15 times

during project

10-15 times during

project lifetime

5-10 times during

project lifetime

1-5 times during

project lifetime

Seldom

Very high

A

High

B C

Occasional


Control rating - example

C3

C2

C1

C0Poorly controlled, risk is addressed at best but not documented or implemented, or at worst no control or

control not addressing the risk appropriately.

Adequately controlled

The control addresses the risk but it documentation and implementation could be improved

The control addresses the risk, at least partly, but it documentation and implementation could be

improved


Risk ranking - example


Risk matrix


What to retain?


• Have a plan and follow it

• Lay eyes on the biggest threats to the project and manage them in a pro-active manner

• Opportunities should not be forgotten

• Use external, neutral facilitator if needed

• Involve all the project players in the process: risk management should work top-down and botom-up


References and further reading

• ISO 31000:2009 Risk management – Principles and guidelines

• ISO Guide 73:2009 Risk management - Vocabulary

• ISO 31010:2009 Risk management – Risk assessment techniques


6th African Rift Geothermal Conference | ARGeo-C6

Short Course 1 | Project Management for Geothermal Development

Organized by: United Nations University Geothermal Training Programme (UNU-GTP)

Financed by: Icelandic Ministry for Foreign Affairs – ICEIDA and Nordic Development Fund

Coordinator: Ingimar G. Haraldsson, UNU-GTP

Lecturers: Anthony Ng‘ang‘a Ngigi, Geothermal Development Company, Kenya

Carine Chatenay, Verkís Consulting Engineers, Iceland

Peketsa Mwaro Mangi, Kenya Electricity Generating Company, Kenya

Yngvi Gudmundsson, Verkís Consulting Engineers, Iceland