Risk Analysis & ManagementRisk Analysis & Management

PhasesPhases

Initial Risk Assessment Risk Analysis Risk Management and

Mitigation

Risk Assessment for Initial Risk Assessment for Initial Business CaseBusiness Case

Looking at Uncertainty

Why the Initial Risk AssessmentWhy the Initial Risk Assessmentis neededis needed

To decide whether it is worth proceeding with the project

As an input into the Value Management study As an input into the Scenario Analysis As an input into Risk Management As a factor in deciding Project Strategy (inc.

Purchasing)

Definitions of Project RiskDefinitions of Project Risk

Narrow Definition Risk is the possibility that project

objectives may not be achieved

ORWider Definition

Risk is a recognition of the uncertain outcome of any project

Initial Risk AssessmentInitial Risk Assessment

Clarify the project objectives Identify all the possible risks For each risk assess:

the probability of occurrence the potential impact on the project if the risk

occurs the overall ‘seriousness’

Identify potential ‘show-stoppers’

Project ObjectivesProject Objectives

Risk cannot be assessed unless the project objectives are clear

Most projects have a range of objectives The project ‘Sponsor’ needs to identify the

main ‘business drivers’

But, each ‘Stakeholder’ will have his/her own priorities for the project

A hierarchy of objectives should be agreed

Objectives HierarchyObjectives Hierarchy

Business Objectives must be part of the objectives hierarchy

Key Objective

Prime Objective

or Reason

Sub-Objective

Identification of RiskIdentification of Risk

Internal Risks Project resources are inadequate

External Risks A key supplier goes bankrupt Market collapses

Uncertainties Future exchange rates

Record risks in a Risk Log

Probability of OccurrenceProbability of Occurrence

No risk has 100% probability of a particular outcome - if it does it becomes a certainty

Suggested range of probabilities: - “Likely” - a probability of 50% or more is high “May happen” - a probability of 25% to 45% is

medium “Unlikely” - a probability of 20% or less is low

Impact of RisksImpact of Risks

The cost of implementing the project will be higher than expected

The time taken to implement the project will be longer than expected

The required technical or commercial performance (or quality) of the deliverable will not be achieved

Impact ratings of ‘High’, ‘Medium’ or ‘Low’ should take account of any planned risk management actions

Seriousness RatingSeriousness Rating

Probability

High Medium High High

Medium Low Medium High

Low Low Low Medium

Low Medium High

Impact

Check-list:Check-list:Initial Risk AssessmentInitial Risk Assessment

Have the project objectives been clarified? What are the risks of failing to meet these

objectives? What other uncertainties exist? Does the assessment of risk identify any

potential ‘show-stoppers’? If so, can anything be done to reduce the risk?

Are you convinced that there is an acceptable balance between risk and reward?

Risk and Scenario AnalysisRisk and Scenario Analysis

Considering Different Project Outcomes

The Risk Management ProcessThe Risk Management ProcessRisk Analysis

What are the uncertainties,

probabilities andimpacts?

Value Management

What are the options?Define preferred option

Scenario Analysis

What is the range of probable outcomes?

Risk Containment

How do we control the outcome?

Full Risk AnalysisFull Risk Analysis

Verify Risk Log Estimate percentage probabilities Score potential impacts Rank seriousness of risks Explore options which will mitigate risks

(using Value Management study) Prepare ‘scenarios’ to demonstrate range of

possible outcomes for the preferred option

Quantification of RiskQuantification of Risk Estimate percentage probabilities Score potential impact on scale 1 - 10

1 = lowest impact - perhaps because it will be easy to manage the risk if it occurs

10 = sufficient impact to halt project - and no effective risk management countermeasures are envisaged

Multiply percentage times score to give a seriousness rating

A seriousness rating above 2.5 could represent an ‘unacceptable’ risk - establish threshold for project

Seriousness Rating = 2.5Seriousness Rating = 2.5

0

10

20

30

40

50

60

70

80

90

100

1 2 3 4 5 6 7 8 9 10

IMPACT

PR

OB

AB

ILIT

Y

Full Risk Analysis: SummaryFull Risk Analysis: Summary

The Risk Log should list those events which might affect the outcome of your project

The seriousness of each risk is defined as the percentage probability times the impact

A numerical threshold of acceptability can then be defined - but a high potential reward would justify a higher threshold

The next steps are Scenario Analysis and Risk Management

Scenario AnalysisScenario Analysis

Trying to define the range of possible project outcomes: ‘Pessimistic’ ‘Most Likely’ ‘Optimistic’

This is an alternative the more traditional Sensitivity Analysis

Probability Distribution - Graph Probability Distribution - Graph 11

Probability

Outcome

Most Likely

Pessimistic Optimistic

Using Scenario Analysis Using Scenario Analysis

For each area of uncertainty (in the Risk Log), define the ‘pessimistic’, ‘most likely’ and ‘optimistic’ outcomes

Record these using a Scenario Template Use these assumptions to prepare three

financial scenarios in the Financial Appraisal - ‘pessimistic’, ‘most likely’ and ‘optimistic’

The pessimistic and optimistic scenarios should represent the extreme outcomes which have realistic probability of happening

Risk ManagementRisk Management

“No project is risk free. Risk can be managed, minimised, shared, transferred or accepted. It must not be ignored.”

(Sir Michael Latham, 1994)

Risk ManagementRisk Management

Review the risk log Prepare contingency or pro-active actions Try to benefit from uncertainties Consider risk transfer mechanisms Allocate responsibility for risk management Monitor progress against the risk log Take decisive action when risks occur

Risk ManagementRisk Management

Identify Risk

Determine appropriate action(s)

Contingency:- only invoked

when necessary

Pro-active:- taken before

risk occurs

REDUCE OR ELIMINATEADVERSE IMPACT

MAY IMPROVEEXPECTED OUTCOME

Accept Risk -no action identified

Risk Transfer MechanismsRisk Transfer Mechanisms

One pro-active strategy is to transfer risk to another party - e.g. a supplier or insurance

This does not eliminate the risk - it merely shifts the responsibility for that risk

“Risk should be borne by the party which is best able to manage it”

Allocate ResponsibilitiesAllocate Responsibilities

Allocate responsibilities to those best able to handle the risks

For example, the Purchasing Manager should handle risks associated with external suppliers

Ask managers to look for upside potential as well as avoiding downside risk

Monitor Progress and Take Monitor Progress and Take ActionAction

A Risk Management Log should identify responsibilities, proposed actions and dates

This log should be reviewed regularly as the project progresses

If unforeseen problems arise, then immediate action may be needed

Issue LogIssue Log

An optional “action list” based on the Risk Management log

Defines who is responsible for any actions not already pre-planned as part of the WBS

Links Risk Management Log to the Change Management Log

Risk Management: Risk Management: SummarySummary

Try to anticipate all possible risks Plan how do deal with these risks Allocate responsibilities or transfer risk Monitor progress and be prepared for the

unexpected Act promptly when risks occur