Abstract
Risk is inevitable in any project, program, or portfolio, as are changes to an organization's missions and business objectives throughout the lifetime of a project. Since projects are implemented by organizations, project risk management decisions also impact the organization's strategic objectives. Therefore, changes in project risks or organizational changes require realignment of project objectives with the mission of the implementing organization.
Adaptive project risk management offers a strategic approach to ensure continued alignment of a project, program, or portfolio with the organization's business needs. However, implementation of adaptive risk management in low maturity organizations (LMOs) faces many challenges, such as lack of experience, governance, and necessary resources.
This paper discusses strategic risk management, and adaptive risk management processes, and presents three case studies on the application of risk management in LMOs. These case studies demonstrate that LMOs can be benefited by risk champions to initiate risk management processes and improve overall organizational prioritization and realization of business goals.
Introduction
Project risk management can be viewed as a series of activities that are planned to achieve success by proactively integrating risk evaluation in the selection of alternatives, and then controlling the risks associated with the implementation of the selected alternative (NASA, 2013). Risks impact project objectives and require the project team to respond in a manner that helps the organization to meet their business goals.
As organizations go through changes that require modification of business plans, strategic objectives, and missions, the objectives of the projects, programs, and portfolios implemented by the organization require realignment to adapt to the new business goals. Adaptive project risk management is a strategic approach to ensure continued alignment of project objectives with the organization's mission.
Organizations that are relatively new to formal project management typically do not implement a systematic project risk management process due to lack of policy, limited experience, or financial concerns. Project management practices in these organizations with low project management maturity, termed low maturity organizations (LMOs), generally focus on scope, schedule and budget. As a result, these agencies are not fully prepared to handle project risks proactively.
Project risk is often misconstrued as a health and safety risk that can be handled by developing a safety plan. Instead of performing systematic risk management, some organizations increase project budget by a certain percentage of the project cost as a contingency to deal with unforeseen circumstances. This approach could be viewed as a risk acceptance strategy; however, the contingency estimating is typically not based on systematic risk identification and response planning. Furthermore, project risks continue to change during a project due to numerous factors such as regulatory, political, environmental, and global economic changes.
LMOs, in particular, are not prepared to adapt to the changing degrees of risks. The adaptive risk management approach focuses on continued monitoring of risks and modifications of response strategies to ensure continued alignment of project objectives with the implementing organization's strategic plan. Utilization of adaptive risk management in LMOs would allow these organizations to better control their projects and programs by strategically assigning organizational resources to meet the overall mission. For example, to realign an infrastructure project's objective with an organization's mission, a floor plan may need to be scaled down based on revenue decline projections.
This paper will introduce strategic implementation of adaptive risk management, discussing applications in LMOs by presenting three real life examples where a strategic risk management approach was applied to successfully implement projects under constant changes. These examples will illustrate how adaptive risk management was leveraged to help organizations meet goals and stakeholder requirements. Lessons learned from these examples can be transferred to improve the organizational project risk management approach of many types of organizations.
Perception of Risk in Low Maturity Organizations (LMOs)
The project management maturity of an organization can be described by the Project Management Maturity Model (PMMM), which utilizes a five level system for evaluation (Kerzner, 2009, pp. 890–891). Organizations falling into PMMM Level–1 recognize the importance of project management; however, they do not have common processes for managing projects. An organization that acknowledges the need for a common process, but does not have a singular methodology is considered at Level 2. An organization at Level 5 is the most advanced in project management and is continuously improving singular methodology by benchmarking. This paper considers organizations with PMMM Level 2 or below as a LMO.
During the 1990's, organizations started to acknowledge that implementing project management is not choice rather; it is a necessity (Kerzner, 2009, p. 45). A LMO may recognize the importance of project management, but they only utilize informal and inconsistent project management practices. These organizations typically acknowledge external uncertainties such as weather, political, and market conditions as project risks, but do not perform any strategic planning to mitigate the likelihood or impact.
A formal project risk management process includes risk management planning, identification, qualification, quantification, risk response planning, and monitoring. A formal project risk management process is not typically implemented for LMO projects, programs, and portfolios. Project planning efforts for LMOs focus on cost estimating and scheduling. These organizations typically increase the project budget by a certain percentage or add floats in schedule as a contingency to address project uncertainties. Contingency estimates are typically either based on previous experience of the organization or by following a rule of thumb. Typically, the management decides when to use the contingency fund to address unexpected conditions. Use of a contingency fund is not limited to project risk management; it is often used for additional work, schedule recovery, and other unplanned activities.
Importance of Strategic Project Risk Management
Project delay, cost overrun, scope creep, and unsatisfactory performance have plagued many projects, programs, and portfolios. A study on transportation project estimating found that for the last 70 years the costs for transportation projects were consistently underestimated globally (WSDOT, 2010). One of the main reasons for the inaccuracy of cost estimates is inadequate consideration for project risks and the impacts. Unsuccessful project deliveries in LMOs can often be attributed to unmanaged project risks.
Organizations that are striving to improve project delivery recognize the need to improve project management. Unfortunately, due to resource constraints, lack of experience, and ineffective planning, project management process improvement becomes an onerous mission. Many LMOs focus on improvement of cost estimation and scheduling techniques, but ignore project risk management, which plays an essential role in improving the accuracy of cost estimates, schedule, and scope control. Project risk management provides early warning of uncertainties and potential outcomes related to the project, program, portfolio or organizational business processes. This allows coordination of risk information with the appropriate levels of management to ensure a comprehensive decision-making response. Strategic implementation of risk management can help to ensure risk response decisions are coordinated appropriately within the organization.
A project's performance is typically measured by comparing actual scope, schedule, and cost with the project baseline. Project baselines that are established using inaccurate data will not be very useful to measure actual project performance. A sound project risk management methodology can help a project team to develop and manage a risk adjusted cost estimate and schedule, as a result, the project baseline is more reliable and the project performance can be measured with a high degree of accuracy. This is an important factor in effectively managing organizational resources for all projects, programs, and portfolios. Risk decisions that greatly influence the organizational resource utilization, require a strategic planning approach to ensure timely and effective implementation of risk responses.
The project risk management process consists of planning, identifying, qualifying, quantifying, determining response strategy, and controlling risks throughout the project (Project Management Institute, 2013, p. 309). Many organizations such as the Washington State Department of Transportation (WSDOT) have developed a customized project risk management guidance to provide a consistent methodology for managing risks (WSDOT, 2010). Development of guidance is a good first step; however, adaptation to the new process requires systematic implementation through training and on-going support. In order to establish sound project risk management processes, all levels of management within the organization need to provide documented support and necessary resources to meet the agency's strategic goals. Sound risk management requires planning, developing, and nurturing a culture of project management. The organization should provide a project management culture where project teams, senior management, and other key stakeholders work collaboratively through each phase of project delivery to manage risks. Everyone within an organization involved with project, program, or portfolio management is responsible for managing project risks, and management should include accountability gates or check points to ensure that project risks are being monitored and controlled. Organizations that are successfully managing project risks and adapting to changes have established a risk management culture which is defined by their values, visions, and missions. A successful risk management culture is attributed to the following values of an organization (Caltrans, 2012):
Make risk decisions by balancing project values and organizational priorities
Challenges in Implementing Strategic Risk Management
Organizations that deliver projects, programs, and portfolios deal with numerous challenges such as market conditions, resource constraints, stakeholder's needs, and productivity. Within an organization there are often projects and programs with multiple competing priorities and shared resources. Since the organizational structure of LMOs is typically functional or poor matrix, timely and effective utilization of shared resources among several projects can be challenging. Additionally, LMOs typically lack governance structure, policies, a project management office (PMO), and a detailed procedure for risk management. Lack of a PMO not only affects systematic management of shared resources, but also jeopardizes identification and implementation of project management methodology.
Implementation of a strategic risk management approach requires planning and development of a comprehensive project management process aligned with the strategic objectives of the organization. Standardization of project management processes requires a concerted effort by an organization to develop and implement policies, processes, and methodologies to support the use of effective project management. Lack of policies or project governance is a barrier to implementation of a systematic risk management process.
Strategic risk management requires comprehensive planning, coherent across the organization, and integration of risk decisions with the goals of the agency. In order to seamlessly align risk decisions with the strategic goals, all risks within a portfolio need to be analyzed collectively and decisions need to be coordinated horizontally and vertically across the organization. LMOs are not typically organized to integrate portfolio level risks in a coherent framework to foster a strategic risk management approach. Organizational project management (OPM) strategy integrates organizational enabling practices with project, program, and portfolio management to deliver organizational strategy for improved products, results, or services (PMI, 2013, p. 7). Implementation of OPM could be beneficial for strategic planning and implementation of risk management within an organization. However, development and implementation of OPM requires extensive project management experience, senior management support, and an integrated governing structure for the organization.
Facing resistance to change in the attempt to implement new project management processes is a challenge and requires a systematic change management effort. Leadership must foster a project management culture by integrating project management with the core business processes and the values of the organization. Certain behavioral expectations of organizational personnel are necessary for the systematic and effective execution of the methodology.
Championing Project Risk Management
Strategic risk management requires organizational project management skills, leadership foresight, and corporate governance for effective implementation. Since LMOs lack organizational support for project risk management, often a risk champion within the organization must initiate the risk management effort. Executive champions work closely with senior management and can be effective in implementing sound project risk management. A visionary executive who realizes the importance of proactive risk management approach would be able to demonstrate to the organization how it can benefit from this effort.
A project team member or a project manager with critical thinking skills may become a risk champion and could motivate the team to initiate implementation of a risk management approach. A project team member can get motivated by learning about the benefits of risk management from their colleagues, attending training, or gathering information from other sources to become a risk champion. Since there is no formal guidance for risk management in a LMO, a risk champion plays a critical role in demonstrating the benefits of risk management to the entire team. A risk champion could also facilitate dissemination of risk information to key stakeholders to gain their support. Stakeholders can also become risk champions to facilitate the development and implementation of a risk management plan. The case studies discussed in this paper provide examples where risk champions at the project level were instrumental in implementing risk management.
Adaptive Project Risk Management
Under a constantly changing global economic and political environment, organizations are continually modifying their business plan to sustain and adapt to the change. Organizational, and the associated enterprise environmental factor changes, require projects, programs, and portfolios to realign their strategic approach to adapt with the changing environment. Changing environments affect both projects and the organization; a project's objectives may need to be reevaluated to ensure that the outcome of the project adds value to the agency. The strategic risk planning approach helps the project management team forecast the anticipated changes and proactively implement response options. Mature organizations continually monitor project risks and adjust strategies as needed to ensure continued alignment with the portfolio, program, or project objectives. When an organization changes its mission or business plan, on-going projects and programs need to be evaluated to determine validity. As a result, the objectives of the projects, programs, or portfolios may need to be realigned with the organization's new strategic goals. Realignment may require change of project scope, modification of schedule, or improved service delivery.
Adaptive project risk management is a strategic approach to ensure continued alignment of portfolio, program, and project objectives with the organizations missions. Integrated risk decisions are used to realign projects and adapt with the changing organizational environment. Project risk decisions may also require modifications to the organizations business plan, policies, or governance structures. Organizations may be required to add resources with specialized skills to address project risks.
The adaptive risk management process includes the risk management policy for the organization, strategic planning, consistent implementation, integration of risk decisions with the business plan, and documented support from all management levels within the agency. Typically, mature organizations have a risk management policy that provides clear directions on the risk management objectives, applicability, authority, and guidance. The goal of a risk management policy is to ensure that the organization makes informed strategic decisions with respect to the activities that it undertakes, by systematically evaluating consequences of their decisions on the project objectives and their business plan.
Implementation of adaptive risk management requires a risk management culture where consolidated efforts are made by the organization to integrate business processes with a governance structure to ensure risks and decisions are coordinated at appropriate management levels. Similarly, organizational business decisions must consider effects on the portfolio implementation and adaptation of projects with the changing missions.
Adaptive Risk Management Approach
Risk management planning and implementation for a project, program, or portfolio can be tailored to meet the organizational requirements. Strategic planning helps maximize benefits of risk management by focusing on project risks that are most critical for the organization. Organizations with limited resources should assign staff to critical risks that if not managed proactively could impact not only the project, but also the functionality of the overall organization. As an example, flawed implementation of an accounting system due to an unmanaged risk could impact the overall functionality of the organization by providing erroneous or outdated financial information. Whereas, a project risk that has low impact on the project and the organization could be handled after dealing with the critical risk. A scalable approach can be applied for risk management, where projects, programs, and portfolios that are most critical to the success of the organization are dealt with at a higher priority level and less critical risks are addressed with reduced effort.
Adaptive risk management requires a strategic risk management approach and orchestration of risk decisions with all levels of management within the organization. Adaptive risk management is a continuous process and follows plan-identify-monitor-respond-adapt process. Risk management is planned then implemented, monitored, and controlled. Adaptive risk management evaluates how the project risk response option may require the project to adapt with the changing environment of the organization. As an example, economic decline may require an organization to provide the same level of service with reduced number of employees. As a result, the project team will be required to function with fewer resources and longer hours. This situation could impact the project team's moral and may reduce quality of service. Adaptation to this changing environment would require modification of culture through realignment of project objectives with the new mission of the organization. Leadership plays an important role with the adaptation process by providing the necessary resources to overcome transitional barriers and embrace the new organizational culture.
Implementation of the adaptive risk management approach at the project level may become an onerous task and not be beneficial. Based on the organization's structure, missions, and governance, adaptive risk management can be effectively implemented at the portfolio or program level. In a mature organization, risk management strategies are planned, coordinated, and prioritized by the PMO. These organizations analyze their lessons learned from the results of the on-going risk management efforts and modify their strategic approach to adapt to a changing risk environment. LMOs are not able to enjoy the benefits of a PMO that strategically plans risks across the portfolios or programs. Risk champions could play a critical role by coordinating the risk management approach with various management levels in the organization and prioritize risk handling strategies to optimize overall benefits for the agency. However, senior management involvement is essential to orchestrate risk decisions within the organization for adaptive risk management.
Case Studies — Demonstration of Adaptive Risk Management
The following section describes three case studies of LMOs where benefits of adaptive risk management were gained by strategically planning and implementing risk management measures.
a. Factoria Recycling &Transfer Station Project
In 2009, the King County Solid Waste Division (SWD) in Washington State initiated the Factoria Recycling &Transfer Station (FRTS) project to design and build a new municipal solid waste management facility. The estimated project cost was approximately US$90 million with duration of five years. This facility will receive solid waste from King County and several other municipalities through an agreement. The current agreement will expire in 2028, and will need to be renewed by the municipalities to allow continued receipt of waste and collection of fees. Any changes to the system participation during the renewal could result in an impact to the revenue generated by the SWD.
In 2011, a consultant was hired to conduct the project management needs assessment by reviewing and analyzing the current policies, processes, protocols, tools, and templates used for SWD projects and programs. Based on the consultant report the SWD project management maturity level was 1.83 (Sauerburn, 2011). In 2011, the SWD introduced a new executive initiative to standardize project management processes by aligning processes with A Project Management Body of Knowledge (PMBOK® Guide)—Fifth Edition (PMI, 2013). King County designated FRTS as a high risk project and mandated implementation of new project management standards. As a result, the FRTS project management team developed a risk management plan and started monitoring and controlling project risks. Since the project management culture in SWD was going through a significant change, the project team members, managers, and key stakeholders experienced adaptation challenges. During the same timeframe, SWD was also going through organizational and business changes. In 2011, SWD conducted a service delivery study which indicated a declining trend for revenue. Declining revenue was attributed to reduced volume of solid waste (tonnage projection) generated by the municipalities. The reduced tonnage projection not only affects the FRTS project, but also impacts the overall organizations business plan.
Late in 2011, FRTS was at 60 percent design stage and the project management team recognized that the current design may need to be modified otherwise the constructed facility could be oversized. The oversized facility would be more expensive to build and maintain. Since the tonnage projection depends on several factors, including the economic condition of the western Washington region, the uncertainty associated with the projection was high. Therefore, the tonnage projection decline had a high level of uncertainty and was not a reliable indicator to proportionately reduce the facility size. In a higher maturity organization, the PMO would probably conduct a risk quantification process by applying Monte Carlo simulation to evaluate various scenarios associated with the tonnage decline risk. Instead of conducting a risk quantification process, SWD held several management level risk response planning meetings and revisited the agencies master facility plan (a documented basis for establishing the need for FRTS). Based on the strategic planning meetings, senior management provided the direction to scale down the footprint of the constructed facility to adapt with the declined revenue projection. Scaling down the facility sizing reduced the projected project costs by $7 million and allowed SWD to create a management reserve fund to handle future unknown-unknown risks.
In 2013, during the new agreement negotiation with other municipalities it became evident that some of the major municipalities contributing solid waste to the system had decided not to extend their participation after 2028. A municipality's business and operational decision depends on their elected official's leadership. Unfortunately, when this decision was made by elected officials the FRTS project design was at the 100 percent level. Redesign of the project would be expensive; meanwhile there is no guarantee that a change in leadership of the non-participating agency may reverse the decision in the near future. In order to address this political risk, King County's elected officials got involved and provided directive to the project team to freeze expenditures and revisit the overall business plan. The project team is adapting with the risk decision by strategically performing critical tasks to minimize schedule delay and control costs. Risk decisions for this project will be coordinated with all levels of management and will be integrated with the updated business plan. The FRTS project will be re-baselined after the risk mitigation decisions are incorporated in the scope, and the cost and schedule are updated. The project team will continue to adapt with the changes to ensure continued alignment with the SWD‘s business goals.
b. Tolt Levee Setback Project
In 2007, King County and the city of Seattle initiated a capital project to setback a mile long levee on the Tolt River to improve fish habitat. The estimated project cost was US$7.5 million with duration of three years. In order to minimize project cost and to meet the funding constraints, the project team explored various alternatives including reconstruction of the setback levee by utilizing the materials recovered from the removal of the existing structure. Removal of the existing flood containment structure before installing the new setback levee creates a risk of flooding, but if managed effectively, reuse of materials from the existing levee would save a significant cost of purchasing new construction materials. This acts as an example of a risk that if managed effectively would provide opportunities, but failure to address would be a threat.
The project manager of this team became the risk champion and initiated a risk management process to evaluate alternatives by identifying, categorizing, assessing impacts, and developing risk response options. The team elected to refine risk response options to gain potential benefits by managing the risks that were categorized as opportunities. As an example, one of the risk mitigation options for the aforementioned risk was to construct the project in summer when the probability of flooding would be low.
Most of the stakeholders of this project were risk averse and were uncomfortable with the teams’ risk tolerant approach. The project management team realized the need for helping the stakeholders understand the probability, impact/benefit, and strategic approach to proactively manage risks.
Since the project management maturity level of the implementing agency was low, there was no formal project risk management process. In order to gain stakeholder's support, the project team engaged the key members in the risk management planning process. In collaboration with the stakeholders, the project team identified several project risks and developed risk response options. The risk response plan identified various levels of risk mitigation strategies, benefits, and contingency costs. After the stakeholders participation in the risk planning process they were more knowledgeable about the risk probability and strategic response options. Some of the stakeholders were convinced that proactively managing risks would help the project meet its objectives at a lower cost. Risk appetite of the stakeholders grew as they became aware of potential cost savings.
In 2009, this project was successfully completed within budget. The project team was able gain benefits by exploiting positive risks and proactively monitoring and controlling negative risks. The overall risk handling approach for this project was a positive influence on the implementing organization and helped the agency to adapt to a new standard for future project risk management and adjust to a new project management culture.
c. Des Moines Creek Basin Restoration Program
In 2003, King County, Port of Seattle, Washington State Department of Transportation, and the cities of Sea-Tac and Des Moines initiated the design and construction of a suite of restoration projects through the Des Moines Creek Basin Restoration Program. This program consisted of five capital projects to improve stream habitat and mitigate flooding on Des Moines Creek Basin in Washington State. The program cost was approximately US$30 million with a planned duration of five years. Since the project management maturity of the implementing organization during that time was low, these five projects were managed separately rather than as a program to maximize benefits and controls. If those projects were managed as a program, a consistent project management methodology could have been applied to ensure sound project management practice.
Des Moines Creek Regional Detention Facility (RDF) project was the largest project in this program. The RDF project was designed to construct a 130 acre-foot regional stormwater detention pond adjacent to the Sea-Tac International Airport. During the project planning phase, the team along with the multiple key stakeholders identified numerous technical, political, regulatory, environmental, and organizational challenges to designing and constructing the RDF project. The project team consisted of more than 12 engineers, scientists, and other regulatory professionals, all highly motivated to overcome the challenges by performing technical investigations, engineering analysis, and modeling.
One of the major project risks was uncertainty about the area that would be excavated to construct this large storm water pond. As a LMO, the project management team was not required to follow any formal risk management process. However, the project team held brainstorming meetings to identify risks and started developing risk response options for some of the major risks. The main goal of these brainstorming sessions was to better define the project scope, update the cost estimate, refine the schedule, and develop a project permitting strategy.
The team identified uncertainty with the soil chemistry for the 58,000 cubic yards of planned excavation as the highest risk. In order to develop a risk response strategy the team proposed a two tier soil boring and chemical analysis. The team proposed this soil testing to the client as a proactive measure to better define construction and the proper soil handling technique. Initially some of the clients were not pleased with that proposal because of the additional cost and were uncertain about the need for such an exploration. The project management team became the risk champion and educated the clients on the need for such testing and the benefits. The team was able to gain support from one of the major clients who also became an executive risk champion. After several strategic planning meetings, the team negotiated a scaled back soil exploration plan.
The project management team continued to work with the executive risk champion and they were able to perform strategic risk response planning by executing a three tiered soil exploration scheme. As a result, the project team was able to develop a construction plan, cost estimate, schedule, and regulatory compliance approach with a very high degree of accuracy. The tiered risk response planning approach helped with gaining clients support to successfully complete construction of the RDF project within time and budget. The strategic risk response approach helped the project team to develop and execute a methodical and cost effective construction technique.
This case study demonstrated that in a LMO a risk champion can be instrumental in proactively managing risks by gaining an executive sponsors support. Once the executive sponsor becomes the executive risk champion, they can provide leadership to the organization for strategic risk management. The RDF project risk management required the team to adapt to continued client concerns and expectations.
Lessons Learned
The case studies discussed above indicate that the need for project risk management became evident when a threat or an opportunity arose and a project risk champion initiated the risk response options. These cases illustrate leadership at project level to both proactively manage risk and develop greater understanding of the interrelationship between project risks and the organization's strategic objectives. The strategic approach and the collaborative venture with stakeholders and senior management facilitated the organization's improvement of their project risk management approach.
Even in a LMO, the need to consider project risks and to continually align with organizational changes is critical for project success. In these organizations, there are no established risk policies, governance, or processes to consistently apply adaptive risk management. In a LMO, the coordination of organizational changes with project objectives tends to be driven initially by actions at the project team level. Even though risk management was initiated at the project level, risk decisions required engagement of the senior management to coordinate and integrate expected outcomes with the organization's missions. The author believes that despite the relative successes of the projects cited, LMOs often fail to address changes in organizational strategy or business decisions due to lack of effective communication between the organization's strategic objectives and the project, program or portfolio execution processes.
These are the key lessons learned from these case studies:
- Senior management support is important to project teams for identifying strategic changes in the organization. The benefit of communicating these changes downward to the project teams is typically not realized in LMOs.
- Prioritization of critical project risks from the organization's business strategy at the portfolio, and program levels can lead to greater ability of the project teams to proactively manage those risks.
- Engagement of the project team with the executive and senior management can be effectively initiated in a LMO by project risk champions. Senior management and stakeholders were supportive when risk champions documented the benefits of strategic risk management.
- Positive risk management cases can influence an organization's motivation for advancing project and risk management processes.
- These cases demonstrated limited success at the project level, but a more comprehensive organizational adaptive risk management process is required to ensure continual project alignment with the strategic objectives of the organization.
Conclusion
All organizations regardless of their project management maturity levels deal with project risks. Mature organizations follow a standardized policy and procedure to strategically manage risks. LMOs are not typically equipped or resourced properly to strategically apply these risk management measures. Risk champions play a critical role in the proactive project risk management, especially in LMOs where they can initiate and advocate the need to stakeholders. Senior management should foster project management culture and empower employees to become project management and risk champions.
Changes are inevitable for all organizations and their projects, programs, and portfolios. Organizational changes will impact how their projects are funded, staffed, and implemented. Project risk impacts and the response strategies not only impact the project objectives, but also affect the organizational resources and their business goals. Projects, programs, and portfolios are not implemented in isolation, all are executed by organizations. Therefore, the organizational environment and project parameters are interlaced and mutually affect each other. In order to continue to achieve organizational strategic objectives, portfolio objectives will need to be realigned during changes. Applying adaptive risk management will help organizations strategically plan, develop, coordinate, and implement risk decisions at appropriate levels in the implementing organization.