Project risk analysis to support strategic and project management

Faithful and Gould


Successful project cost and schedule risk management is always capable of informing project management of “where the project is” and “where the project is going” in the future. Current project controls technologies are capable of supporting strategic decision making on the level of a megaproject or a set of concurrent projects. Cost and scheduling risk analyses are the main elements used to support both strategic management and project management. The assessment of the performances of general contractors and subcontractors determines the impact on project objectives. Cost and schedule risk analyses support strategic planning and decision making for mega-projects. Moving project risk analysis from individual projects into enterprise systems allows the organization to manage the whole portfolio of projects. This leads to supporting strategic decision making on the management of capital project selection and resource optimization. This paper explains the kinds of cost and schedule risk analyses and the level of detail that would be needed to support both strategic management and project management.


Strategic management as defined by Nag et al. (2007) is a field that deals with the major intended and emergent initiatives taken by general managers on behalf of owners, involving utilization of resources, to enhance the performance of firms in their external environments. Strategic planning is viewed as a process for determining where an organization is going over the next few years — typically 5 to 20 years. In order to determine the direction of the organization, it is necessary to understand its current position and the possible avenues through which it can pursue a particular course of action (Thornton, 1986). Strategic planning is a tool for organizing the present on the basis of the projections of the desired future. That is, a strategic plan is a road map to lead an organization from where it is now to where it would like to be in five or ten years (Armstrong, 1982). Effective strategic planning can mean the difference between long-term success and failure.

Operations management is defined by the Business Dictionary (2012) as, “The design, execution, and control of operations that convert resources into desired goods and services, and implement a company's business strategy.” Project management is the application of knowledge, skills and techniques to execute projects effectively and efficiently. Strategic competency for organizations enables them to tie project results to business goals — and thus, better compete in their markets (PMBOK® Guide —Fourth Edition). Strategic planning for project management, combined with a good project management methodology, can compress the gaps on time, cost, and quality.

From these definitions, it is clear that projects represent a vital role in many organizations and affect and get affected by the operations management. Moreover, project portfolios and megaprojects with long durations affect and get affected by the organization's strategic plans. This paper focuses on the project controls information that supports both operational project management and strategic decision making.

Projects may be classified based on their size, ranging from US$10,000 to US$10 billion. They can be tiny, small, medium, large, very large, or megaprojects. Project management and controls are required for all project sizes. Professional project management might not be required for tiny and small projects. On the other hand, strategic planning and support for decision making is required before the beginning of all projects. However, the focus of this paper is on the projects that require strategic planning during the course of project execution. Tiny, small, and medium projects are usually completed before there is any need for another strategic decision. Large projects may comprise a few strategic decisions or may not. Exhibit 1 illustrates the needs for project management and strategic management for different project sizes.

Strategic projects are those projects that are of critical importance to enable the organization as a whole to have a competitive advantage. There are three attributes to having a core competence. The three attributes are: it adds value to customers; it's not easily imitated; and it opens up new possibilities in the future. There are two aspects to project management. One aspect is the actual selection of the types of projects that the organization engages in, and second, there is implementation on how the projects themselves are managed.

With ever-increasing globalization, companies need to respond rapidly to change at all levels in order to maintain their competitive position and sustain growth; hence, the ability to conjoin vision, strategy, and strategy implementation using a robust, flexible, and responsive delivering methodology is essential. This use of project management to implement strategic objectives and manage overall operations has seen a commensurate growth, a practice often referred to as management-by-projects.

Both megaprojects and portfolios of projects require strategic decisions during their life cycles. Megaprojects are usually above US$1 billion in value and have five or more years of life cycle. The large value of megaprojects might impact the future of the organization or brand reputation. That makes it necessary to make important strategic decisions during the conception and initiation phases and more strategic decisions during the planning and execution phases. Because of the multi-year project duration, many variations occur in technologies, economic environments, and organizational priorities. These variations create the need to make many strategic decisions during the planning and execution phases of the project.

Project sizes and their needs for project management and strategic management

Exhibit 1 – Project sizes and their needs for project management and strategic management

For example, between 2010 and 2012, the U.S. government granted one-year depreciation for all projects put in service before the end of each year. For a US$ 1 billion project, this would increase the net present value of the product of the project by US$50 million. All managers of projects that are scheduled to complete during the fourth quarter of 2012 and the first quarter of 2013 tried their best to analyze different what-if scenarios to complete their projects before the end of 2012. In a few projects, this process involved a schedule acceleration cost in the magnitude of tens of millions of dollars. Project schedule acceleration increases both safety risks and business risks This would either cost millions of dollars, or would compromise safety, which is priceless, and would negatively impact the reputation of the organization. Whether or not to accelerate the project schedule becomes a hard strategic decision to be made toward the end of the project.

Portfolios of projects, regardless of project size, require a continuous process of making strategic decisions. Project selection and prioritization are a simple example of a strategic decision for project portfolios. Prioritization happens before a project starts and during project life cycles. The main goal of strategic decision making in the case of project portfolios is the alignment of project objectives with the strategic goals of the organization. Strategic decision making describes the process of creating a company's mission and objectives and deciding upon the courses of action a company should pursue to achieve those goals. Project management provides better ways of making decisions that impact the future of the organization. Project management provides a structured procedure for resolving problems. Because project management deals directly with customers, it is considered a better tool for delivering solutions through a well-defined project team. This improves customer relations and product quality.

This paper presents the types of risk information that supports strategic decision making and at the same time serves the project management day-to-day decision making. As shown in Exhibit 2, project risk analysis supports both project management and strategic management by providing the relevant information from the beginning to the end of the project. Project controls provides “where we were,” “where we are,” and “where we are going.” Each stage has its own needs for information that supports the decision-making process.

Project Controls Support from the Beginning to the End of the Project

Exhibit 2 – Project Controls Support from the Beginning to the End of the Project

The rest of the paper will focus on project risk categories that support these stages. It explains how project risks impact decisions by both senior and project managers. It also explains the kind of information that should be provided in different project phases. The paper discusses the cost risk information, the schedule risk information, and the safety risk information needs. In many organizations, different functions of project controls work separately while they are integrated functions in other organizations. For the efficiency and accuracy of the information, an integrated project controls function that encapsulates cost, scheduling, risk, and knowledge management needs to be implemented. This integrated system uses more than one software tool from the current market but keeps all of their data in a centralized database. Integration provides a simultaneous study of the risk impact. For example, a schedule risk will impact the project's budget. It is unwise to study the impact on the schedule separately from the impact on the budget.

Project controls support senior management project management teams in achieving the following objectives:

  1. Project Management Objectives:
    1. Safety of personnel, environment, and property
    2. Project under budget
    3. Project within schedule
    4. Claim avoidance
    5. Accurate forecast of multiple contracts
  2. Project Strategic Goals:
    1. Zero incident
    2. Improve brand reputation
    3. Cost below industry norms
    4. Maximum net present value (NPV)
    5. Zero impact of changes on project economics
    6. Optimized organization resource

Risk Information

Risk is a future phenomenon. As part of our eternal quest to control some small component of our future, it is the focus of many business discussions, thus making it an essential part of our decision making. The challenge comes in creating a degree of consistency in managing risk and the risk process (Pritchard, 2010).

A project risk team keeps two risk registers. The first register keeps record of all safety, health, and environmental risks. This type of risk is also called pure risk. The other is the business risk register, which deals with schedule and cost risks among other business issues. For a megaproject or a portfolio, there should be a full-time risk champion working within the project controls group. The risk champion facilitates risk workshops with the project team to keep both risk registers updated all the time. The project controls group is responsible for the following:

– Identify, prioritize, and manage risks in each area of the project

– Coach the development of mitigation/contingency plans

– Use appropriate techniques to identify potential hazards

– Assign risk owners

– Ensure that the entire project team is engaged in the risk management

– Ensure that the risk management process is used across and throughout the entire project life cycle

The risk champion maintains the safety risk register to do the following:

– Hazard identification (What can go wrong?)

– Consequence analysis (How bad can it be?)

– Likelihood analysis (How often will it happen?)

– Determining risk significance (What does it mean?)

– Developing risk reduction options (What can we do?)

– Decision making and implementation of the risk reduction options (What will we do)

– Keeping the project manager to stay on top of project risks

– Communicating with risk owners

– Making sure that risk-reduction plans are developed

– Informing the team when a risk is closed

When these actions are properly implemented, the project will be able to avoid virtually all safety, health, and environmental risks. Although these risks are the responsibility of the project's safety group, the project controls team maintains the register and keeps the project team informed about all risk updates. Having the safety risk register administered by the project controls group guarantees that many safety risks are owned and avoided by project team members other than the safety team. There are many examples of this; one example is the lift of heavy objects in the construction site. These lifts are planned by engineers and monitored by superintendents. Heavy lift boundaries are controlled by the safety team, but the lift process is performed by others. The risk champion disseminates the risk information to all parties involved in the process.

This supports project managers in maintaining the safety of personnel, environment, and property. To help senior management keep the zero-incident goals, the risk champion collects risk and accident information from other projects within the industry. This entails an effort to contact project teams from similar project across the globe. This additional effort increases the length of the safety risk register and makes the project team aware of every possible problem. This extra step proved to help avoiding many safety problems and keep the zero-incident goal in many megaprojects.

The business risk register contains all risks not related to safety. Risks of engineering errors, technology changes, vendor errors, work delays, weather delays, union strikes, and availability of the right resources are examples of business risks. Analysis of the impact of business risks on the project budget aids in making project management decisions. Analyzing the impact on project economics supports strategic decision making.

The risk champion has a great role during the initial cost estimates and during the initial project scheduling. Quantitative risks are classified into three types of risks:

  1. Known/known or well-known uncertainty and well quantifiable impact. Quantification of the impact of these risks represents an allowance in the project budget and an allowance in the project duration. It is known to the project management team that these allowances will likely be consumed.
  2. Known/unknown or well-known uncertainty, but the impact cannot be quantified. There is a portion of the budget that is put aside as a contingency fund. This fund may or may not be used by the project; however, in most projects, a big portion of this fund is consumed. Also, there is a schedule allowance added for the total duration of the project.
  3. Unknown/unknown. These are the risks that the project team cannot imagine happening and, of course, their impact cannot be quantified. A contingency fund that is managed only by senior management is set aside for this type of risk. In many projects, this fund is not used.

The business risk register is a live document that is updated frequently to capture risk impacts of any changes by management or by contractors. In the life cycle of the project, new known risks arise due to changes in the technology, the economic environment, company mergers and acquisitions, and team re-allocation. These changes represent business risks, which might lead to a loss or an opportunity. The risk champion should be on top of these risks and communicate their impact to the project manager, the cost engineer, and the scheduler.

Cost Risk Information

Megaprojects go through a series of studies from taking the project from an idea to the beginning of the execution. During these feasibility studies, many decisions are taken. The main decision is whether the organization initiates the project or not; examples of other decisions are the location, the technology, and the capacity of the project. Oil and gas companies use the stage-gate method to evaluate different decisions. Cost information represents the main factor behind all of these decisions. Cost estimators play a great role during these studies.

Estimates provided to the project team are usually in the order of magnitude during early stages of deciding whether to start the project or not. Estimators work side-by-side with economic or business analysts to determine different options and to make big decisions on which option supports the strategic goals of the organization. When moving to the technology selection process, cost estimators, and risk champions play a bigger role. The estimates need to be more accurate, with errors of around 25%. Business risks need to be well analyzed at this stage to study their impact on different options and different selections.

The Blue Sky Program (Zein Heymans, 2012) is an example of cost and risk analysis during the early study stage. The program consists of five large to megaprojects. Two investment-phasing options to address the objectives were identified and presented to the approval authority:

– Option A: Concurrent execution

– Option B: Phased execution

Since the full economic benefit of each individual project could only be achieved when the program was completed in its totality, it was common thinking that these individual projects had to be executed simultaneously in order not to lose significant NPV due to idle capital. The project team evaluated all critical factors to optimized NPV and concluded that a phase approach could increase NPV by about 10% and reduce capital by about 20%. This is a good example of using cost and risk information to evaluate these options in order to support senior management for making such a strategic decision.

Combining the analysis of fund availability, risk of idle capital, and risk of labor availability, recommended the scenario of phasing projects instead of executing them simultaneously. Exhibit 3 – Risk of Fund Availability on Mega Project Execution demonstrates the fund requirements for both options. It is clear from the chart that option B is recommended over option A.

During the technology selection stage, a cost control is minimal, because the spending for front-end analysis is not high enough to consume a cost control engineer. However, in many megaprojects, the front-end analysis has a budget that ranges from US$20 to US$100 million, which is a large project's budget. If this is the case, a cost engineer is needed to monitor the cost and produce a forecast for the remaining stages of the project. Also, at that stage, the cost controls function drafts the project cost control plan and reviews it carefully with project management to make sure that it is feasible.

At this stage, the whole project's accurate forecast coupled with cost risk analysis, and the fund availability, allow senior management to make many strategic decisions. The priority of the project within the organization determines whether the project gets the available funds. The project controls group's accurate forecasts are crucial in this strategic decision-making process. This process is common for portfolios of projects; although it isn't heavily used in megaprojects, it should be.

During the technology selection stage, decisions include the physical location, competing projects in the area, any environmental compliance issues, and labor availability requirements. As these studies are evolving, business priorities for the program are shaped. These are translated into a must and want list that feeds into the decision criteria of the program. These also help the project team to align the design basis with the business objectives. The decision criteria and business priorities may take the shape of a complicated decision tree analysis that adds intricacy to the decision-making process. Designing a project to meet future and uncertain project requirements may expose the program financially if future projects are not executed.

When the project moves to the execution stage, the cost control function plays a great role in monitoring and re-forecasting the project cost during different phases. This provides continuous support for the project manager as he or she makes project management decisions. The main objective for project managers is to keep the project under budget. The cost controls function produces an accurate forecast to reflect:

  • Risk impacts
  • Scope changes
  • Price escalations
  • Schedule impacts
  • Unavoidable claims
  • Loss of productivity
Risk of Fund Availability on Mega Project Execution

Exhibit 3 – Risk of Fund Availability on Mega Project Execution

The use of earned value analysis is recommended to produce an accurate project status and an accurate forecast. To support the project manager, the cost controls function produces the following measures in addition to the forecast:

  • Cost incurred
  • Cost of work completed
  • Accruals
  • Estimate To Complete (ETC)
  • Estimate At Completion (EAC)

The project controls team and the risk champion support project managers in managing and in making decisions for project changes. The mechanism of change management is set to track all changes (big or small) in any account within the project:

  • Project Controls studies the impact of a change on the budget and on the schedule.
  • A few changes might increase the forecast but shifting funds from closed accounts keeps the forecast steady.
  • Shifting funds between different subcontractors.

Cost risk analysis provides good insight for both project managers and senior managers for the best-case scenarios for cost under-runs and worst case scenarios of cost overruns. Cost risk analysis depends on a well-developed cost estimate and a well-developed forecast.

Schedule Risk Information

Scheduling provides a roadmap for the project team of who does what and when. Exhibit 4 shows a simple Gantt chart with three bars for each activity. The yellow bar is the baseline and the purple bar is the schedule of that activity's previous week. The green bar is the schedule of the activity this week.

This chart gives the project manager insight on the activity performance compared to the baseline and the performance from week to week. This is one example of how scheduling supports the project management.

Exhibit 5 shows a milestone progress chart, which tracks the date of each major milestone from month to month. These charts give senior managers a snapshot of the whole project. These charts greatly help in making strategic decisions of when to start or to close another project, especially if there are fund restrictions. They help senior management decide on timing. For example, if Project 1 depends on Project 2, another project within the organization, then Project 2 should be completed by a certain date, to allow Project 1's execution to be on schedule. These charts also help senior management optimize the owner's critical resources.

Simple Schedule Analysis Chart

Exhibit 4 – Simple Schedule Analysis Chart

The curve of the milestone of mechanical, electrical, and instrumentation (MEI) construction in Exhibit 4 shows that the milestone was becoming late until it started on October 2011. A careful look at the graph shows that every other milestone follows the same pattern of the MEI milestone. It can be noted that a few milestones are showing earlier dates in the latest schedule update. This improvement happened because the senior management decided to pay multi-millions for accelerating the project. The decision to pay large amounts of money and the decision to accelerate the project are both strategic decisions. For example, the depreciation bonus that increases the NPV of the project would lead to accelerating the project completion.

Schedule risk analysis provides what-if scenarios for both project managers and senior managers. It is noted from practice that a well-developed schedule helps in analyzing what-if scenarios. For example, a schedule that has lags and leads and many non-start-to-finish relationships, will produce misleading risk analysis results. For such a schedule, consultants produce a model with no lags and all finish-to-start relationships and apply PERT analysis on it. This analysis produces a great set of charts and what-if scenarios; however, these charts are meaningless because they are based on an ill-defined schedule.

The degree of uncertainty in each schedule activity and each line item cost element is represented by a probability distribution. The probability distribution is usually specified by a “three-point estimate.” The three points are estimated during risk workshops with subject matter experts who usually focus on the schedule or cost elements one at a time. The risks that lead to the three points are recorded for the quantitative risk analysis report and for risk response planning. For each activity or cost element, a probability distribution type is chosen that best represents the risks discussed in the interview with the risk owner. Typical distributions usually include the triangular, beta, normal, and uniform.

Milestone Progress Chart

Exhibit 5 – Milestone Progress Chart

A specialized Monte Carlo simulation software program runs (iterates) the project schedule or cost estimate many times, drawing duration or cost values for each iteration at random from the probability distribution derived from the three-point estimates and probability distribution types selected for each element. The Monte Carlo software develops from the results of the simulation a probability distribution of possible completion dates and project costs. From this distribution it is possible to answer such questions as:

– How likely is the current plan to be executed on schedule?

– How much contingency reserve of time or money is needed to provide the organization with a sufficient degree of certainty?

– Using sensitivity analysis, which activity contributes the most to the possibility of overrunning the schedule or cost targets?

This analysis helps both project management objectives and strategic management goals. It is noted by Hulett (2011), that integrated cost and schedule risk analysis provide a better understanding of the management of how the project uncertainties will behave during the project course. It is suggested that these analyses be tied to the risk register and any suggestion about the three-point cost or duration should come from subject matter experts with the approval of the risk owner.

The bottom line of providing the appropriate support for both project managers and senior managers is to have an industry-accepted schedule that has enough details to make both micro decisions and strategic decisions. Then, a well-built schedule with a minimal number of lags, non-finish-to-start relationships, low durations, and low amount of float guarantee the appropriate support for making the right decisions.


The paper presented some of the information that would be needed for supporting both project management and strategic management. Three major project risk management areas need to be well established to support the management. These areas are the cost risk, schedule risk, and safety risk analyses. These areas need to follow the excellence practice published by organizations like PMI or government organizations. If these recommendations are not followed, the support will not be effective or may be misleading. Misleading information results in making the wrong decision, which might lead to a disaster for the project or the performing organization. It is recommended that the project risk management personnel review and analyze what the computer tells them to make sure that the information makes sense to everyone on the project team. If the data given to the computer are incorrect, or the model used by the computer is erroneous, the resulting information will be misleading. The project risk management team should analyze the results to make sure that they provide meaningful information to management.


Armstrong, J. S. (1982). The value of formal planning for strategic decisions: Review of empirical research.

Strategic Management Journal, 3, 197–211.

Business Dictionary, (2012). Retrieved from

Hulett, D. (2011). Integrated Cost-Schedule Risk Analysis. Surrey, England: Gower Publishing Limited.

Nag, R., Hambrick, D. C., & Chen, M.-J. (2007). What is strategic management, really? Inductive derivation of a consensus definition of the field. Strategic Management Journal, 28, 935–955.

Project Management Institute (2008). A guide to the project management body of knowledge (PMBOK® guide) — Fourth Edition. Newtown Square, PA: Author.

Pritchard, C. L., (2010). Risk management: Concepts and guidance, Fourth edition, ESI International.

Thornton, J. S. (1986). Futuring: Strategic planning for making your visions come true. American Society of Association Executives.

Zein, R., & Heymans, L. (2012). Quantifying risks related to the execution of ‘mega’ projects, AACE Annual Meeting, San Antonio, Texas.

©2012, Mohamed El-Mehalawi, PhD, PMP
Originally Published as a part of the 2012 PMI Global Congress Proceedings – Vancouver, Canada