Project risk analysis, like all risk analyses, must be implemented using a graded approach; that is, the scope and approach of the analysis must be crafted to fit the needs of the project based on the project size, the data availability, and other requirements of the project team. Los Alamos National Laboratory (LANL) has developed a systematic qualitative project risk analysis technique called the Risk Factor Analysis (RFA) method as a useful tool for early, preconceptual risk analyses, an intermediate-level approach for medium-size projects, or as a prerequisite to a more detailed quantitative project risk analysis. This paper introduces the conceptual underpinnings of the RFA technique, describes the steps involved in performing the analysis, and presents some examples of RFA applications and results.
Description of the Risk Factor Analysis Process
Overview of the Risk Factor Analysis Process
The objective of the RFA is to identify and understand the underlying factors that ultimately will drive the behavior of the toplevel schedule, cost, and technical performance measures for a project. The primary steps involved in conducting a risk factor analysis are as follows:
• List activities, tasks, or other elements that make up the project
• Identify applicable technical risk factors
• Develop a risk-ranking scale for each risk factor
• Rank risk for each activity for each risk factor
• Sum results across risk factors for each activity
• Document the results and identify potential risk-reduction actions for evaluation by the project team
Each of these steps is described in the subsections that follow.
List Activities Modeled
The first step in RFA is the identification of the activities, tasks, or elements of the project to be evaluated. If available, the project work breakdown structure (WBS) and the baseline schedule can be used as the starting point for the identification of important activities. Using this information and data obtained from discussions with the project team, the analyst develops a project activity flow chart to help organize the RFA. The flow chart defines the tasks to be modeled and their interrelationships for the project schedule analysis. WBS and schedule tasks may be consolidated and/or expanded to explicitly highlight those tasks and influences that are expected to have a significant technical risk and/or significant uncertainty in schedule or cost performance. The flow chart is developed in sufficient detail to allow the items important to overall schedule and cost performance to be evaluated individually, yet it is simple enough for all key tasks and their interrelationships to be viewed easily.
Identification of Risk Factors
Risk factors are the issues, topics, or concerns that may ultimately drive the behavior of the top-level schedule and cost performance measures for a given activity. The aim of the RFA is to systematically search the selected project activities for the presence of such risk factors. To aid in the identification of relevant risks, the risk project spectrum first is divided into four broad categories of risk generally found to be relevant to all LANL projects.
1. Technical Risk. Technical risks are those events or issues associated with the scope definition, research and development (R&D), design, construction, and operation that could affect the actual level of performance vs. that specified in the project mission need and performance requirements documents. Examples of technical risks include new and changing technology and changing regulatory requirements.
2. Schedule Risk. Schedule risk is the risk associated with the adequacy of the time allotted for the planning, R&D, facility design, construction, and startup operations. Two major elements of schedule risk are (1) the reasonableness and completeness of the schedule estimates for the planned activities and (2) the risk that schedule objectives will not be met because of a failure to manage technical risks. An example of risk in this category would be schedule delays resulting from failure of the Department of Energy (DOE) to complete reviews and approvals of technical, safety, and management documents within the durations provided in the project schedule.
3. Cost Risk. Cost risk is the risk associated with the ability of the project to achieve the planned life-cycle costs. Thus, it includes both design/construction and operating costs. Two major elements of cost risk are (1) the accuracy and completeness of the cost estimates for the planned activities and (2) the risk that cost performance will be affected adversely by a failure to manage technical risks. An example cost risk would be to have all proposals for a significant contract come in over the estimated budget for that item.
Exhibit 1. Example Qualitative Risk Factor Ranking Criteria
Exhibit 1. Risk Categories and Generic Risk Factors for Risk Factor Analysis
4. Funding Risk. Project schedule targets may not be met because the projected funding needed to conduct the planned activities is not available when needed. In turn, schedule delays caused by underfunding can produce a need for increased funds. Thus, a complete risk assessment must include an evaluation of funding supply or budgetary risks. An example of this type of risk would be DOE failure to provide adequate funding or a change in priority for the project from DOE or the Congress.
Exhibit 3. Example Risk Factor Evaluation
Exhibit 1 shows the four risk categories and their interrelationships plus generic risk factors found to be broadly applicable to LANL projects for each risk category. The specific risk factors listed can be modified and supplemented with additional factors applicable to a specific project or program.
Qualitative Risk Ranking Guidelines
A method to systematically document the risk for each qualitative risk factor identified in Exhibit 1 is needed to perform a consistent evaluation of risk across the different project or program activities. To make this possible, qualitative definitions of risk for each of the risk factors are defined for three categories of risk (none/low, medium, and high). Some examples of these risk-ranking definitions are presented in Exhibit 2.
Risk Factor Evaluation
The identified project or program activities are evaluated systematically against the risk factors using qualitative risk factor rankings similar to the Exhibit 2 example. The evaluation can be performed by project personnel after training in the approach or by the risk analysis team based on interviews with the project team members. The results are recorded on worksheets prepared for each project activity. These worksheets document the risk ranking for each risk factor for each project activity using a system in which the qualitative categories from Exhibit 2 were given numerical values as shown below.
| Risk Ranking | Value |
| None | 0 |
| Low | 1 |
| Medium | 2 |
| High | 3 |
In actual application, intermediate values such as 2.5 are used when appropriate. Numerical values are assigned to the qualitative risk-ranking categories to facilitate the later assembly of results and development of probability distributions. The risk-ranking worksheets also record the justification for the risk assignment and reference the appropriate documents or interviews.
A simple example of a completed evaluation is shown in Exhibit 3.
Uses of Risk Factor Analysis Results
RFA results have been used to aid LANL project management in three important ways. First, the qualitative risk factor rankings for each project activity provide a first-order prioritization of project risks before the application of risk-reduction actions. This general ranking process is shown by the project activity results given in the bottom row of Exhibit 3. This example shows that, in order, activity C represents the highest risk, followed by B and then A. A more robust example of RFA ranking results for an actual project at LANL is shown in Exhibit 4.
Exhibit 4. Actual Risk Factor Analysis Activity Ranking Results
The second, and more meaningful, result from conducting an RFA is the identification of possible risk-reduction actions responding to the identified risk factors. Risk-reduction recommendations are often straightforward to make when the risk issue is identified. However, the value added from the RFA approach comes from the systematic and comprehensive nature of the RFA process and the confidence that is built in the project team and other stakeholders as a result of having performed the analysis. An example of risk-reduction recommendations identified through the RFA process is shown in Exhibit 5.
The final use to which RFA results have been applied at LANL is the development of input distributions for quantitative risk modeling. The integrated qualitative and quantitative risk analysis process is shown in Exhibit 6.
Note that in the RFA process, the potential effect of a risk factor on project performance is the focus of concern not its likelihood of occurrence. The issues identified in the RFA and the risk-reduction actions implemented in response to these issues now can be documented and weighed by the risk analyst to define defendable input distributions for quantitative risk modeling that account for both the consequence and likelihood of risk issues.
Conclusion
This paper has introduced a systematic qualitative project risk analysis technique called the RFA method. The RFA technique has been used at LANL as a tool for early, preconceptual risk analyses, an intermediate-level risk analysis approach for medium-size projects, or as a prerequisite to a more detailed quantitative project risk analysis. The steps involved in performing the analysis and actual results from LANL projects have been used to illustrate the RFA process. It is the hope of the authors that the RFA technique may provide project risk analysts with a useful and cost-effective tool that can be applied to a broad spectrum of projects and programs.
Exhibit 5. Example Risk-Reduction Recommendations From RFA
Exhibit 6. Integrated Qualitative and Quantitative Risk Analysis at LANL
