The management of medium to large complex procurement and integration projects is a difficult challenge. Project decisions at the startup tend to focus on decisions on how to achieve near term goals and milestones. Risk management activities are often viewed by leadership as a project expense with little or no return and, as a result, are generally not properly implemented.
The ability of the project manager to implement proven Event Based Risk Management (EBRM) techniques will result in the increased leadership credibility of the project manager in the eyes of the project team, peers, and management, along with improved probability of project and organizational success.
Project risk management doesn't have to be expensive or time consuming—the key is keeping the scale and cost of managing risks in proportion to the scale of the project itself and the types of risks that are presented.
The goal of this presentation is to describe the proven project risk management techniques and to assist attendees in how to use these techniques as part of an overall project communication and management approach.
Project staff members, generally, are overloaded, especially at project startup, when they are actively involved in a number of simultaneous and critical tasks. Where possible, additional staff is assigned to assist the project and, due to schedule constraints or cost overrun pressures, begin supporting the project immediately to attempt to show progress and improve schedule and cost performance. As a result, project plans are generally often not read or followed.
Furthermore, project staff members tend to delay admitting that their project contains risk, as well as delay communicating risk and how to deal with the risk. The tendency is to identify risks that are outside the project manager's control because it's easy to do so. There is also a general lack of understanding, identification, and effective management of the interrelationship and linkages between various risk areas within the project and the organization.
Experience has shown that the above behavior ultimately results in projects failing to meet their goals. To avoid this, it is critical that the project manager be able to understand what the key project issues and risk areas are and always be in a position to communicate these effectively to internal and external stakeholders. It is also important for executive management to be able to quickly determine where and when these concerns are active within a project.
The Link between Project Success and Risk Management
All projects implicitly have associated risks. Organizations that adhere to strong project management methods, including in-depth evaluation of scope, schedule, and cost, ongoing risk management, and measurement of project results, are consistently more successful than those that do not. Risk management processes go hand in hand with strong project management. Project management without proper consideration and integration of risk management, in the opinion of the author, is not true project management.
Risk management is a continuous project process, as shown in Exhibit 1.
It is important that the project manager be able to understand what the key project issues and risk areas are and be able to communicate these effectively to internal and external stakeholders. It is also important for executive management to be able to quickly determine where and when these concerns are active within a project.
Following a structured project risk management method enables projects and organizations to predict and respond to risks, better manage costs, and deliver quality results that satisfy stakeholders. In the most mature project management organizations, these project goals are directly linked to strategic business objectives, giving these organizations a powerful competitive advantage. This is the basis of project portfolio management.
Unfortunately, risk management activities are often viewed by leadership as a project expense with little or no return. A major challenge to most organizations is appreciating how project risks interact across the organization and how to maximize the opportunities among them.
For a project and an organization to be successful, leadership must foster an environment in which there is a healthy perspective on risk and its management. The goal is to have a culture in which all decision making within the organization, whatever the level of importance and significance, involves the consideration of risks in an atmosphere where there are no risks that are out-of-bounds for discussion.
Management of risk has to be embedded in the management philosophy right from the top and it must support the realistic and open recognition of project risks, even if they indicate problems with the project. Otherwise, stakeholders may develop a narrow focus on risks, exposing the project to unnecessary delays, negative financial impacts, and potential damage to the organization's reputation.
Event Based Risk Management
Event Based Risk management (EBRM) is a proven management technique and should be an integral element of any project; it is equally applicable during the project planning and the execution phases. EBRM offers the following discriminators:
- Top-down approach to provide the big-picture view, as opposed to a bottom-up approach
- Event-centric view, with a focus on key events/deliverables
- Inherent schedule analysis to increase the probability of project success
- Key artifacts that greatly facilitate understanding of the entire project and of the key risks to the project. These artifacts are extremely effective for communicating important project information to both the project team and to other stakeholders, such as senior management
- Consultative inputs from others who have had similar experiences and leverage of the lessons learned
The integration of EBRM into project planning and execution is the key to its success. Further information may be found in “The Benefits of Event-Based Risk Management in Project Execution,” presented by the author at the 2009 PMI Global Congress North America.
The EBRM process overview is shown in Exhibit 2.
The EBRM process is an iterative process, applicable to both the proposal and execution phases of a project. It is also of benefit in addressing specific problems or challenges within a project phase. For example, EBRM may be used to assist in the planning of a technology insertion activity in a large system where many stakeholders are involved. EBRM may also be used to address the steps required to correcting a major deficiency of a software build within an overall project. If EBRM was not implemented during the proposal phase of a project, the project manager should consider implementing the EBRM process as soon as possible, if for no other reason than to facilitate project monitoring and improve communications with the project team and stakeholders.
Critical Success Factors
There are several factors that lead to successful EBRM implementation and they include:
- Having a sound knowledge of proven project risk management principles and processes;
- Understanding and being able to effectively communicate a project to various stakeholders;
- Properly documenting and analyzing project assumptions for risks;
- Knowing how to apply the proper level of risk management to a project;
- Developing a properly structured project schedule;
- Ensuring risk management activities are properly included in the project schedule;
- Recognizing the benefits of schedule and cost risk analysis;
- Tempering optimism with reality; and
- Implementation of an effective stakeholder risk communication strategy.
The above list is based on the experience of the author and represents proven techniques that form the basis of no-nonsense project risk management, which every project manager should address as part of his or her current projects.
Understanding the Basics
A Guide to the Project Management Body of Knowledge (PMBOK® Guide)—Fourth edition, defines project management as the application of knowledge, skills, tools, and techniques to project activities to meet project requirements. Inherent in all projects is uncertainty. Risk is generally viewed as a state of uncertainty, in which some possible outcomes have an undesired effect or significant loss. A more appropriate definition of a project risk is an uncertain event or condition that, if it occurs, has a positive or negative effect on project objectives.
It is important that the project manager be knowledgeable and fully versed in the PMI project risk management principles, concepts, and processes. The six risk management processes that are recognized as good practice in most projects, most of the time, are shown in Exhibit 3.
A common misconception is that risk management is supplementary to the project management set of processes. A more appropriate approach is to view risk management as core to the overall project management approach. Effective risk management is critical to project success and must be forward looking and continuous.
An alternate method by which to view the six project risk management processes is shown in Exhibit 4. Effective risk management is critical to project success and must be forward looking and continuous.
There are number of reference books, handbooks, textbooks, and courses, which are available to help project managers become more familiar with project risk management processes, tools, and techniques. An excellent reference book is PMI's Practice Standard for Project Risk Management, which clearly builds on the principles underlying the six project risk management processes as outlined in the PMBOK Guide®—Fourth Edition.
Develop an Executive Project Summary
Clearly show understanding of your project by developing a single page high-level view, with the key activities and milestones identified. Without a clearly understood overview of the project, there is an increased likelihood of project rework and delays.
The Executive Project Summary (EPS) is a composite event diagram that captures, on a single page, the key events and considerations over the life cycle of the project. This graphic representation provides project managers, project teams, and executive management with a comprehensive overview of a project, no matter how complex, and facilitates a common understanding of project goals. Without a clearly understood overview of the project, there is an increased likelihood of project rework and delays. A sample executive project summary is shown in Exhibit 5.
The EPS has the following key characteristics:
- Illustrates a high-level, single-page view of the project;
- Captures key activities upon which the project is based;
- Depicts “swim lanes” based on how the organization executes a project;
- Identifies significant milestones or events in the top swim lane; and
- Specifies project end date(s) and time remaining.
The EPS is an extremely effective tool for communicating important project information to both the project team and to other stakeholders. It also offers the opportunity to shape constructive team dynamics to ensure focus on common goals.
Exhibit 6 shows the concept of the EPS as a project briefing tool.
The project manager's ability to seek agreement on the goals of the project among the key project stakeholders, including the project team, management, and the customer, plays a large part in the project's success. The EPS is a very useful tool in the project manager's toolkit.
Properly Document and Analyze Project Assumptions
A common item that is often overlooked or improperly addressed is how project assumptions and constraints are identified, reviewed, and documented. Experience has shown that the process of how to manage project assumptions and constraints is essential to clearly understanding project scope, minimizing project risk, and increasing project as well as organizational success.
Assumptions in project management refer to specific items that are considered to be true or certain when planning a project without necessarily having proof of it in reality. Unfortunately, even the most carefully considered ones typically carry with them a certain element of risk and, if not properly addressed, result is a false sense of security in the project, senior management team, and the customer. This is not a good situation to be in and should be avoided.
The following steps are recommended to assist the project manager in this area:
- The project team members should identify and document all of the assumptions and constraints being made in their areas during project planning and iteratively as required thereafter. This may require expertise from outside the project and the organization.
- The project manager should ask the following question on each assumption or constraint:
a. Is the assumption or constraint clear and unambiguous? If not, it should be reworked.
b. Could the assumption or constraint prove to be false—Yes or No?
c. If Yes, would one or more project objectives be negatively or positively affected—Yes or No?
- If both responses are “Yes,” then a risk should be raised by the project manager and a thorough impact and probability analysis initiated.
The project manager and the complete project team must always be aware of all project assumptions and constraints. Major assumptions and constraints must be clearly communicated to senior management and relevant stakeholders.
Determine the Appropriate Level of Risk Management
All projects have risk. Experience has shown that a limited number of organizations claim to be satisfied with the application of risk management in their projects or be able to demonstrate it successfully. Improving project risk management involves two basic objectives: improving the ability to identify and influence risk while there is opportunity in the project life cycle to do so, and embedding the management of risk into the project environment itself.
Effective project risk management requires the generation of a Risk Management Plan (RMP). The RMP is the major artifact developed during the Plan Risk Management process identified in Exhibit 1. The RMP identifies the strategy used to identify and handle negative project risks (threats), both technical and non-technical, before they become issues and cause schedule, cost, or performance impacts. The RMP should also identify positive risks (opportunities), such as schedule enhancements, cost savings, and performance improvements.
The RMP is generally referenced or is part of the Project Management Plan (PMP). The RMP may take on various forms, from a simple spreadsheet for smaller projects, to a separate complicated document for large projects. Numerous templates are commercially available and there are also many available on the Internet.
Project managers need to be careful with the available templates. There is no one-size-fits-all RMP. The risk management activities planned for the project and included in the RMP should be tailored and based upon:
- Project complexity;
- The size and duration of the project;
- The initial overall risk determination of the project;
- The organizational risk tolerance and procedures;
- The available staff members and their skill levels for addressing risk management; and
- The available project data and their quality.
The key is keeping the scale and cost of managing risks in proportion to the scale of the project itself and the types of risks that are being presented to the project and the organization. Spending too much time assessing and managing risks when not warranted for the project at hand can divert critical resources that could be used more effectively.
Develop a Proper Schedule
A schedule is a required tool in project management; unfortunately, the development of proper schedules is not well understood by most project managers. Project managers need to properly understand the implementation and use of proper scheduling methods as a tool to planning, coordinating, and scheduling the execution of projects. This is critical if schedule risk analysis is to be performed at a later stage. A clear and agreed on overview of the project, however, is required first, and as previously discussed the Executive Project Summary is an excellent tool with which to do this. Project managers must avoid the trap in which a schedule “deep dive” is done too early because the available scheduling tools make it easy to do so. Without a clearly understood overview of the project, it will be very difficult to properly implement the project in a schedule, resulting in an increased likelihood of schedule rework.
Scheduling is a difficult discipline to master; most project managers do not have the luxury of having dedicated and properly trained scheduling resources assigned to them. A method by which this may be addressed is for the project manager to become knowledgeable with PMI's The Practice Standard for Scheduling, which provides project managers with the tools and information needed to efficiently and effectively schedule projects. Once a project schedule is complete, it may be assessed for its structure by a number of excellent commercially available schedule assessment tools.
Include Risk Activities in the Project Schedule
Through the proper identification of discrete work activities required to complete the project and the relationship of those activities to one another, a proper project schedule allows for the determination of which activities and deliverables are critical to completing the project successfully.
A common mistake made by project managers is to not include the activities associated with the management of risk in their project schedules. Incorporate risk management activities into the project schedule and do not leave them in a separate risk register. This provides increased visibility of these activities and allows them to be more easily integrated into your project activities. By including risk mitigation tasks in the project schedule, action plan progress and effectiveness can be reviewed on a regular basis and reported at project status meetings. This allows the allocation of resources and budget for these activities.
An additional worthwhile step is to map the project risks in the schedule to program activities through the project work breakdown structure (WBS). This mapping provides a method by which grouping of risks may be identified, highlighting areas where further investigation by the project manager may be required.
Perform Schedule and Cost Risk Analysis
Many project managers rely too heavily on the Critical Path Method (CPM) to provide the most likely completion date and not enough on their own past schedules or experiences. This results in schedule dates, which most of the time are inaccurate and optimistic. Furthermore, project managers simply add up the estimates at completion for WBS components as a way to build up a project cost estimate. This results in cost estimates that are also inaccurate and optimistic, resulting in projects overrunning their cost estimates. To make matters worse, these two activities tend to be done separately without using the data from one to influence the other. The end result is an inaccurate estimate of the project, both from a schedule and cost perspective, leading to potential schedule delays and cost overruns.
The typical project often overruns its schedule and cost estimates. One reason for this is that schedule and cost estimating traditionally fails to take into account that the work may actually take longer (or less) or cost more (or less) than provided by even the most accurate estimates. Future estimates are not facts but statements of probability about how things will occur. Because estimates are probabilistic assessments, schedule and costs may actually be higher or lower than estimated even by seasoned project staff.
Schedule Risk Analysis (SRA) is the application of the Monte Carlo technique to the project schedule. A Guide to the Project Management Body of Knowledge (PMBOK® Guide)—Fourth edition, identifies the Monte Carlo technique as the typical method of modeling/simulating projects (Project Management Institute, 2008). Similarly, Cost Risk Analysis (CRA) is the application of the Monte Carlo technique to the project costs.
These techniques are proven methods to better address the following questions:
- “What chance do I have of finishing the event on time?”
- “What chance do I have of finishing the event on budget?”
- “Why does it cost that much?”
- “Do I have adequate contingency to cover overruns?” and
- “Can I defend and monitor the level of contingency I need?”
SRA ideally requires that the schedule be built using three-point estimates, but this can be modeled based on global or specific assumptions. The principle of SRA is that a large number of schedule simulations are run, and the results of each iteration are statistically analyzed to provide confidence factors in meeting the planned dates of static schedules.
SRAs allow the identification of issues in project or schedule structures, of confidence factors for meeting event dates as planned, as well as of near-critical paths that might not be apparent.
One of the artifacts of the SRA process is the distribution chart plots that predict the finish date(s) of the selected event(s) for each schedule simulation. This will provide the project manager and the project team with an understanding of the likely range of finish dates, the confidence in meeting the target date, and the worst-case scenario completion date.
Other artifacts include the early identification of issues in project or schedule structures, as well as identification of near-critical paths that might not be apparent. Exhibit 7 details an example of an SRA distribution chart, showing the typical distribution of the projected finish dates against the probability of meeting those dates.
In almost all cases, projected finish dates occur later than planned and need to be re-worked to be brought into the target range. SRA is an iterative process. Outputs are fed back into the development of the plan to arrive at an acceptable level of confidence. The goal is to have each event probability in the 80% to 90% range.
Similarly, CRA ideally requires that the project costs be built using three-point estimates. To determine the contingency to be allocated to the project, we need to define what confidence level we would like to achieve: The higher the contingency level, the larger amount of contingency needed. Exhibit 8 details an example of a CRA distribution chart showing the typical distribution of the projected project costs against the probability of meeting those costs. The chart shows that in order to have a 90% confidence factor on project completion costs, the required project budget is US$94 million.
Project managers and staff need to remember that schedule and cost are related. Although SRA and CRA may be done separately on a project, the optimized approach is to implement an integrated analysis of schedule and cost risk to estimate the appropriate level of cost contingency reserve on projects. This allows for the impact of project schedule risk to be determined on cost risk, resulting on an improved estimate of needed cost contingency reserves. Additional benefits include the prioritizing of the risks to cost, some of which may be risks to the schedule so that cost risk mitigation may be conducted in a more cost-effective way.
Break The Cult of Optimism
A key role of the project manager is to motivate his or her team for increased project execution performance. Unfortunately, the level of motivation may result in excessive optimism and result in the project manager and the project team overestimating their degree of control of project activities and their odds of success. This is known as optimism bias and includes a tendency to over-estimate the likelihood of positive events and under-estimate the likelihood of negative events.
Project managers must temper optimism with reality and ensure that their projects are viewed by staff and stakeholders in a balanced and realistic manner. Failure to do so may result in unrealistic schedule and cost commitments, significantly increasing risk within the project and the organization.
Ensuring Adequate Project Risk Communication
Influencing and motivating others in today's global project environment is one of the project manager's biggest challenges. The ability for a project manager to effectively accomplish this results in increased credibility of the project manager in the eyes of the project team, peers, and management along with improved probability of project and organizational success.
A key component of this is the ability of a project manager to effectively communicate project risks to the various project stakeholders. The project manager should develop a risk management communication strategy as part of the risk management planning phase and review this as new risks emerge during project execution. This strategy is required in part to address the fact that the project stakeholder's opinion of the effectiveness of risk management on a project and its project manager is accessed by how well risks are handled when they do occur.
The strategy should include making risk management activities agenda items on regularly scheduled project meetings. Project managers need to communicate the importance and status of risk management activities to the entire project team to keep the project team aligned and focused on the right things. Furthermore, project managers need to leverage the skills and experience of the right people to assist in the project. Be thorough and ensure risk is given the importance it requires.
Communicating risks and corresponding options is often an overlooked step in the project management process. Project managers should alert project stakeholders and team members as early as possible to increase the probability that they will be able to help manage the risk.
EBRM is a project risk management technique and should be an integral element of any project; it is equally applicable during the project planning and the execution phases. There are several critical success factors that lead to successful EBRM implementation. These represent project risk management techniques, which every project manager should address as part of his or her current projects.