Assessing Project Risks

Today, Jun 2005 by Cook, Steve

Applying Science to an Art

The management of risk is certainly not a new concept, yet surprisingly little attention is given to risk management within most of today's projects. However, this trend is changing with recent high visibility events such as the Enron scandal and resulting mandates, such as Sarbanes-Oxley, laying out specific processes with regards to managing and reporting organizational and project risks. Such changes are forcing organizations to transform the way risk management is conducted on their projects. Turning a blind eye to the unknown or a lack of understanding of risk management principles is no longer a valid reason for not implementing a risk management plan. Likewise, there is a growing recognition that early, upfront identification of project risk leads to a far better chance of project success than simply ignoring risks altogether. In summary, creating a deterministic project schedule and cost estimate is no longer sufficient when managing a project.

Project management can be defined as both an art and a science. This philosophy can also be applied to risk management (itself a sub-set of project management). Estimating the chance of a project risk event together with its impact on the project is highly subjective in nature and prone to error and discrepancy among project managers.

What is needed is a formalized, uniformly adopted means of identifying, tracking and responding to project risks. Such formalized approaches and methodologies are generally agreed upon by recognized project management bodies such as the Project Management Institute (PMI) in the U.S. and the Association of Project Management (APM) in Europe.

The third edition of the PMI's, A Guide to the Project Management Body of Knowledge details risk management principles that arguably cannot be ignored or disputed. While such publications do not necessarily advocate full or complete implementation of their content, they do provide a well-structured framework and basis for a project Risk Management Plan (RMP). The RMP should be your "risk management bible" and the key to a successful risk management culture within your project. The Risk Management Plan should determine how risks are identified, into which classifications they should fall, how tolerant you are to their occurrence, and how you should respond to them.

Historically, the focus of risk management has been based upon negative impacts on a project's success. More recently, a growing trend has emerged that also recognizes the benefit of potential positive risk in the form of opportunities within a project. Thus, risks can be viewed as either threats or opportunities and, as such, both should be fully accounted for when planning and controlling a project.

Risks - Threats or Opportunities

Additionally, care should be taken to not confuse uncertainty about schedule and cost estimates with that of potential increases or decreases in these estimates as a result of project risk. The best project estimates are generated by adopting a two-stage approach. First, either deterministic or stochastic (e.g. three point) estimates for project tasks are generated using standard estimating techniques. Stochastic estimates can be then evaluated using risk analysis simulation techniques such as "Monte Carlo" ("Quantitative Risk Management").

The second stage is then to determine an expected increase or decrease in estimates based upon the expected amount of threat or opportunity that will arise from risk events. This second process is highly subjective in nature and best managed using a "Risk Register" (this process is known as "Qualitative Risk Management"). The Risk Register provides a structured means of identifying risks within sections of a project and accurately modeling the risk probability and severity. It also provides the basis for mapping out a risk response plan.

Once the expected amount of risk impact has been determined, a suitable amount of contingency can then be added to the task in question to generate a planned estimate (for both task cost and duration).

Calculating Estimates for Uncertainty and Risk

Risk response is typically in the form of risk mitigation - that is the proactive reduction of risk scores by planning risk reduction steps. Mitigation steps often result in additional work being required and, as such, can actually increase the scope of work within the project - additional worthwhile work that is, without which the project would invariably suffer.

Formalized risk management alone is not the silver bullet of project management. However, adoption of a true risk management process from project start to end does bring additional structure and process to your overall project management plan thus adding even more science to the "art" of project management.

Sieve Cook is president and co-founder of Welcom (www.welcom.com). He can be reached at 281-558-0514 or via e-mail at: info@welcom.com.