Planning: Risk
Project risk management is one of the most critical, yet somehow overlooked, of the project management processes. Risk management is the process of looking forward to a point in the future of the project and imagining why the project might fail, then planning to avoid these failures. It involves analyzing the schedule, the scope, the budget and quality for potential project pitfalls, and adjusting all these items to prevent or account for those pitfalls.
11.1 Plan Risk Management
Process Definition
"Plan risk management" is the process of defining how your project organization is going to address risk management. The nature of the project might lend itself to simple qualitative risk management, or your effort might demand rigorous quantitative risk management. This planning process clarifies that approach for the project team and lays the ground rules for risk management during the project. The output for this process is the risk management plan.Process Assessment
As with Scope, Schedule and Cost management plans, I've never seen one of these. The organizations I work for always have a process in place that everyone just follows. However, since few people really understand risk and risk management, this is a plan that SHOULD be in place!
Figure 21. Plan Risk Management: Inputs, Tools and Techniques, and Outputs. Reprinted from "A Guide to the Project Management Body of Knowledge (PMBOK Guide), 5th Edition" by Project Management Institute, 2013, p. 313. Copyright 2013 by Project Management Institute, Inc. Reprinted without permission.
- Fence Project Charter:The scope statement contains a preliminary list of risks and is an input to the "Plan Risk Management" process.
- Expert Judgment: Outline of a simple but effective technique for conducting risk management for small businesses and small projects.
- PMGT 613 Risk Management Plan Example: This RMP was created as a group assignment for PMGT 613, defining how risk management will be conducted, assigning roles and responsibilities, and presenting tools and templates for the team to use. It represents an output of the plan risk management process.
11.2 Identify Risks
Process Definition
Once the risk management approach has been settled upon, the process of identifying risks must be undertaken. It is imperative that risks be identified and labeled in the correct way in order to provide the best opportunity to mitigate those risks and support the best possible outcome for the project.Process Assessment
The risk identification process is the single most important risk process. In identifying risk, and more importantly in writing good risk statements, the project team has the greatest opportunity to set the team up for success in risk management. Skill in this process is invaluable.
Figure 22. Identify Risks: Inputs, Tools and Techniques, and Outputs. Reprinted from "A Guide to the Project Management Body of Knowledge (PMBOK Guide), 5th Edition" by Project Management Institute, 2013, p. 319. Copyright 2013 by Project Management Institute, Inc. Reprinted without permission.
- Expert Judgement: Essay describing an effective tool and technique to write a risk statement, best allowing response plans to be developed. The value of writing a good risk statement cannot be overstated.
- Checklist Analysis: The risk breakdown structure in this artifact is one of the frequently used checklist tools and techniques for identifying risks.
- Risk Register: This is an example of a risk register, the primary output of the "Identify Risk" process. It contains identified risks, response plans and status reports of risks, among other things.
11.3 Perform Qualitative Risk Analysis
Process Definition
Qualitative Risk Management is the process of prioritizing risks based on their probability of occurrence and their impact on project objectives should they occur. This prioritization identifies the risks that need immediate attention vs. those that can wait to be acted on later.Process Assessment
Qualitative risk analysis is a very easy-to-use process that provides a great visual tool for managing and reporting risk. I've used this often in my professional career and it is an excellent tool for managing stakeholder expectations.
Figure 23. Perform Qualitative Risk Analysis: Inputs, Tools and Techniques, and Outputs. Reprinted from "A Guide to the Project Management Body of Knowledge (PMBOK Guide), 5th Edition" by Project Management Institute, 2013, p. 328. Copyright 2013 by Project Management Institute, Inc. Reprinted without permission.
- Probability/Impact Matrix: Example probability and impact assessment scales for qualitative risk analysis. These scales are subjective and should not replace customer requirements or organizational process assets. Assessment scales are a tool for risk analysis.
- Risk Probability and Impact Assessment: Marine Corps Order 3500.27B is the "Operational Risk Management" document providing policy guidance and assigning responsibility for standardized operational risk management in the Marine Corps. On page 5 (PDF page 9) it has an impact assessment scale broken down into 4 categories ranging from "minimal threat" to "death." This is an interesting expansion from the typical impact assessment scales for scope, schedule, budget and quality. That table is provided here. Assessment scales are a tool for risk analysis.
- Risk Register Example: This is an example of an updated risk register with the results of qualitative risk analysis included. This is the primary output of the Qualitative Risk analysis process.
11.4 Perform Quantitative Risk Analysis
Process Definition
Quantitative analysis involves numerical, statistical evaluation of risks and their potential impact on project objectives. Techniques for quantitative risk assessment include sensitivity analysis, expected monetary value and Monte Carlo modeling and simulation.Process Assessment
Monte Carlo assessment of schedules can be an intimidating activity for those who have never done it. But once you learn how to do it, it's not that hard and can be very revealing regarding weak spots in your schedule. Also, it is now required (as SRA - Schedule Risk Analysis) for Earned Value Management reporting on government contracts.
Figure 24. Perform Quantitative Risk Analysis: Inputs, Tools and Techniques, and Outputs. Reprinted from "A Guide to the Project Management Body of Knowledge (PMBOK Guide), 5th Edition" by Project Management Institute, 2013, p. 334. Copyright 2013 by Project Management Institute, Inc. Reprinted without permission.
- Expert Judgment: Research paper, authored by three of your favorite ERAU professors, comparing the PERT and Monte Carlo risk analysis tools and techniques. The paper was submitted for peer review in 2014.
- Quantitative Risk Analysis and Modeling Technique: This homework assignment used PERT analysis to examine a project schedule. PERT is one of the primary tools and techniques for this process.
- Quantitative Risk Analysis and Modeling Techniques: Advantage Energy case study from PMGT 613 uses the PERT method, a tool and technique of the quantitative risk analysis process.
11.5 Plan Risk Responses
Process Definition
Planning risk responses involves deciding which response approach to use for each risk, then creating a plan for addressing that risk. Approaches for responding to negative risks include:
- Avoid
- Transfer
- Mitigate
- Accept
The project team can develop approaches for addressing either or both the probability and impact of qualitative risks, or comprehensive approaches for addressing quantitative risk.
Process Assessment
Understanding the four approaches to planning risk responses is helpful in thinking through the response options for individual risks. I usually try to think of two responses, and it is often possible.
Figure 25. Plan Risk Responses: Inputs, Tools and Techniques, and Outputs. Reprinted from "A Guide to the Project Management Body of Knowledge (PMBOK Guide), 5th Edition" by Project Management Institute, 2013, p. 342. Copyright 2013 by Project Management Institute, Inc. Reprinted without permission.
- Risk Management Plan: The risk management plan, as an input to this process, provides the guidelines by which project team members will identify risks.
- Strategies for Negative Risks: PMGT 614 homework discussion of tools and techniques for devising risk response strategies.
- Project Document Updates: This updated risk register is an example of a project document that gets updated as an output of the risk response planning process.