Project risk management--by the numbers
Risk management is about optimizing value. Decision analysis provides a logical process for making the right value decisions.
by John Schuyler, PMP
IN DECISION ANALYSIS, we quantify everything. Customarily, we combine the usual triple objectives of time, cost, and performance into a single value measure. Probability is the language of uncertainty, and experts express their judgments about risks and uncertainties as probability distributions.
Most organizations with the objective to maximize shareholder value are well suited to an expected monetary value (EMV) decision policy. EMV is expected value (mean) net present value (NPV) cashflow.
Organizations with multiple objectives and others with multiple decision criteria can also apply decision analysis methods. Then, the logical decision policy consists of measuring value (utility) with a multicriteria value function and maximizing expected (value) utility.
Most projects build or develop some form of asset. The asset's life-cycle model represents how business value depends upon the completion date and changes in the asset's functionality or performance. Exhibit 1 illustrates relationships between the asset model and the project model. Both may incorporate the results of detailed submodels developed to understand particular processes, subproject, or system components. The asset model, itself, may be part of a higher-level corporate or resource planning model. The asset model should always be a stochastic model—incorporating probability distributions. The detailed project model is typically deterministic—without distributions.
Risk management benefits from focusing on the key drivers of uncertainty. In contrast, project execution and control benefit from planning in great detail. The project model contains typically 10 to 100 times more detail as the asset model, in terms of resolution.
John Schuyler, PMP, of Decision Precision® in Aurora, Colo., provides training and assistance in economic decision analysis and in project risk management. Questions about this article should be directed to email@example.com. Comments on this series should be directed to firstname.lastname@example.org.
Pre-Project Risk Management
Risk management begins in the feasibility study. A stochastic (probabilistic) model of the asset life cycle provides the basis for justifying the project. This includes a preliminary and coarse project model for calculating distributions for time and cost to do the project. The structure of the summary project model developed at this stage has a preliminary work breakdown structure or other activity network representation. Include major discrete contingencies. Probability distributions, of course, express judgments about uncertain input variables.
This asset model should be maintained throughout the life cycle. Update this model as new information becomes available. Check the project and asset models after revisions to ensure consistency.
Important risks provide opportunities for improving the project. What alternatives exist to improve the project's risk-versus-value profile?
During the Project
The following risk management functions are numbered as in the PMBOK® Guide.
11.1. Risk Management Planning. In the early stages of project initiation, we design and implement the formal risk management methodology. This defines roles and responsibilities, databases, and control reporting.
11.2. Risk Identification. In detailed project planning, the project team creates the bill of materials, work breakdown structure, and an activity network diagram. The project model details elements in schedule and cost estimation.
Risk Identification is about reviewing every input variable, activity, key material, and resource. What are the threats and opportunities? Checklists built up from others’ experiences are valuable in ensuring completeness. Classifying risks helps identify common and redundant entries. Also, consider potential for changes in the environment; that is, the assumptions may change.
11.3. Risk Assessment. The project base plan is a single scenario where the inputs are expected values for continuous chance variables. I use outcomes nearest the means for discrete variable values. Stochastic calculations, at an appropriate level such as the asset model, are the means to evaluate schedule and cost.
Exhibit 1. The asset model is typically the best level at which to assess important project risks. Project decisions can use information from the asset model, project model, or both, depending upon circumstances.
Exhibit 2. The Base Case is only one scenario, used here as the zero reference. Cumulative distributions show the possibilities. Here we view project cost distributions (which may incorporate costequivalent considerations for schedule and performance) both before and after implementing risk mitigation actions. An asset's value distribution would be similar.
We need judgments for the values of every input variable in the model. The list includes, especially, risks from Risk Identification. Typically, the most capable available persons judge these values. Their assessments include:
Single values for variables that are well known or can be calculated with precision; single values also suffice for less-important variables (prioritized subjectively at this stage)
Probability distributions for important uncertain values in the project model
Probabilities for discrete risk events
Probability distributions for impact variables that become relevant when the associated risk events occur (for example, remedial action cost incurred because of a delayed shipment)
Single values or probability distributions for contingency plan implementation costs.
A probability distribution completely describes a judgment about uncertainty for a single risk event. However, there may be interactions between variables. We further need the experts to describe how judgments, above, are associated (correlated) with one another. Influence diagrams are useful in mapping interrelationship and in designing detailed submodels.
11.4 Risk Quantification. This is about understanding overall project risk. The stochastic asset model is the basis for credible forecasts. Some practitioners carry stochastic calculations through the project model as well, though this may be overkill. A common display of project risk is a cumulative distribution diagram, such as Exhibit 2.
Sensitivity analysis quantifies how uncertainty and changes to input values affect the outcome. Usually, the target outcome is either asset value or project cost, depending upon the model. The purpose of sensitivity analysis is helping prioritize input variables and model construction details.
Prioritizing risk events is important in project risk management. A common graph shows discrete risks versus their conditional impacts, such as either side of Exhibit 3.
11.5 Risk Response Planning. What do we do about the risks? This is the topic of Risk Response Planning. Use brainstorming again and checklists to identify candidate actions for risk mitigation. (For this discussion, we will assume risks are only of the “threat” variety.) Actions typically reduce or eliminate risk or affect the impact should the risk event occur. From among the potential actions, which are cost-effective to implement? The optimal project plan incorporates the combination of actions that adds most value to the organization.
Before-and-after graphs, as shown in Exhibits 2 and 3, are good formats for illustrating the anticipated benefits of Risk Response Planning.
Exhibit 3. This graph characterizes the importance of identified (discrete) risks. Risk mitigation actions affect the probability of the risk event or its impact, sometimes both. For clarity, the illustration omits opportunities. Importance of a risk depends upon both its probability and impact. Risk management attempts to move threats “southwest,” and opportunities “northeast.” Iso-EV contours are one way to segregate risks into importance categories. This presentation is modeled after a chart produced by PROAct project risk management software by Engineering Management Services, Boulder, Colorado.
11.6 Risk Monitoring and Control. An inventory of risks and actions is core to risk management. A database repository is the foundation. Data fields include various classifications, responsibilities, watch points, and time windows. Recording original estimates and actual outcomes is key to judgment performance feedback.
At major milestones or other suitable points, post-implementation reviews are essential for participants’ learning and for capturing knowledge. This is perhaps the single most important way in which to improve an organization's planning and evaluation process skills.
KEEPYOUR PERSPECTIVE. While the outline presented here appears linear, the process is iterative and features rework cycles. The asset and project models should be coordinated, and we alternate between looking at the forest versus the trees.
Building asset and project models in analysis work is fun. Conditional branching is key to making the model realistically dynamic. It is always interesting to experiment, to learn about what is important and how the project behaves under different circumstances. ■
Reader Service Number 083
September 2000 PM Network