In search of risk--interrogate your project for risk

Abstract

Project Managers should really be called Magical Controllers of Uncertainty! Why? Because that is our gestalt -- our form, our being! Our purpose is to make Uncertain things Certain! We organize chaos to make it predictable. Our real job is reducing variation in each of our 500 project activities as they move through our Project Methodology to deliver final durations and final costs falling within the range of our estimate. In reality, we adjust scope, use contingencies, work overtime to influence (control is probably too strong a term for what we do) the trajectory of the outcome so it lands within the estimated range that we fixed months if not years before with little planning and lots of Kentucky windage. Self fulfilling, one might say, we prophets are!

Hear questions to ask while searching for risk in project fundamentals. Systematic searching is necessary because Risk is not always evident nor is it always in the prior experience of the project team. Make searching a team effort – the more diverse, the greater the probably for finding real Risk. Make this search concurrent with planning, estimating, and scheduling – remember our purpose is creating certainty. Use these questions to flush Risk into the open as a trained dog helps the hunt. Look in all the nooks and crannies of a project to identify uncertainty – remembering both threats and opportunities lurk there. Adapt these questions to your experience and to your project flows; create your own checklist to internalize this systematic search for Uncertainty to make it part of your project gestalt. Once a Risk is identified, insert it into Risk Management. Fulfill your destiny to make project delivery predictable – find Uncertainty, both threats and opportunities; properly identify the Risk; then manage this Risk. (Exhibit One)

Introduction

We really should be providing probabilities like the weather forecaster saying we have a 30% probability of finishing in eight months and a 100% probability of finishing in twelve. There are scheduling programs that say they do that using Monte Carlo simulation; however, they depend on our triple point estimates as did PERT sixty years ago. Just what is the probability of the reasonable expectancy? PERT says it is 67% but is it 80% or is it less than 50%. How do you know? PERT says the worst case probability it is 17% but isn’t it 5%? These probability scheduling programs allow you to select one from a few distribution diagrams none of which really reflect the project universe. Just where in your magic kit bag did you learn to calculate distribution ranges (what is the reason for selecting a normal distribution when the project universe is really greatly skewed as PERT recognized?) much less how to predict 5% probabilities? How many 5% probabilities does it take to become significant (nibbled to death by ducks syndrome)? Does not the same happen with cost? Too frequently management is so impatient to start there is not sufficient time given to plan the 500 activities once much less three times. Monte Carlo simulations are wonderful tools but they operate at a macro level depending on guesstimates of the triple durations (can you pick a duration that has 1% change to be exceeded?) as well as unreal distributions of those durations.

Build your Risk questions to flush out Uncertainty where ever it is hiding in your project. Systematically go through your project methodology and through the specific project to ensure you have looked everywhere for Risk and for its Causes. Ask yourself questions whose answers uncover Uncertainty (Variation) or to Certainty. Use structured approaches to find Uncertainty and identify Risk. First use project fundamentals of Results, Scope, and Performance. Look at the underlying Methods then behind at Resources consumed by the Methods. Examine the Team executing Methods. Use the Project System as a reminder to look for Risk in all aspects of a project not just in Project Work. Search for items missed, undefined, or ignored. Learn a structured methodology to identify Risk – just where and what can vary significantly from the expected – for better and for worse. See Exhibit Two.

Exhibit One Project System

Results

The first and most dangerous form of Risk or Uncertainty lurks in Results. If your project does not produce the technical Results, it is a guaranteed failure. Please remember that the reverse is not true – a project can be a technical success producing the Required Results and it can still be a failure. I worked on a 350 million dollar successful Co-Gen project that was never fired up. Another cause of failure can be the destruction of the relationship with the Customer. So before you undertake a project, interrogate the Results and the Customer with questions like these:

Exhibit Two Fundamentals

1. Has this Result ever been produced?
2. Have we ever produced this Result?
3. If not, have we produced anything similar?
4. Can we produce these Results? How do we know this?
5. Does the customer know what they are buying?
6. What benefits are they buying? What detriments do they get at the same time? What will they give up in order to gain?
7. Do we know what we are selling? Is the customer buying what we are selling – is there a ‘meeting of the minds’? How do we know?
8. When does the customer expect the Result and for what Cost? Can we produce the result at that time for that cost? How do we know?
9. How will the customer measure success?
10. Can we implement or commercialize the product from the project? The project is not complete until it is installed and being used. Be careful where you believe the project ends. It can fail during implementation.
11. Do you know the customer? The user? The economic customer? The technical customer
12. What will it take to keep this customer happy while the project is underway? How do you know this?
13. Does your team have proven skills deliver these time and cost requirements?
14. What are the opportunities to complete early? Late? What are the tradeoffs? Does the customer know these trade-offs, these opportunities?
15. What are the opportunities in meeting the budget? In exceeding the budget? There are times that just delivering the project or delivering the project early are invaluable.
16. Why are we doing this project? What is in it for us to do this project? What is in it for us to walk away from this project?
17. What do you not know that you need to know? What have you successfully avoided doing in the past that you should continue to avoid doing?

Planning

When we plan work, we rehearse, we practice, and we build the work on paper. I believe it is important to plan each activity, operation, or job carefully. This detailed planning can vary as to when it happens – even to the point of planning just before doing. (I am not an advocate of not planning even if you have done the same thing fifty times before.) Planning allows us to do things we have never done before. The first astronauts to the moon commented on how the moon walk experience was just like they had rehearsed.

Planning is not the same as scheduling. Planning is analysis; selection of the work method; detailing of materials, tools, people; estimation of cost; sequencing steps to determine activity duration. Plan each of the 500 tasks at least once (at the same time it is beneficial to calculate worst case and best case durations and costs). Scheduling is the organizing of these activities into concurrent networks. Many people think sequentially or linearly – one foot in front of the next. Project durations are dramatically reduced when concurrency is emphasized. Both Planning and Scheduling reduce Risk because we have now built the job on paper. There are dangers in Planning concurrent with Scheduling. First, you lose the benefit of Precedence Diagram – might as well use ADM. Planning and Scheduling must be separate distinct steps in preparing to execute a project. Critical aspects will be missed in planning and in scheduling when doing them concurrently. Look at the activity then look at the relationship to other activities.

Risk Response

Risk Response Planning is the next to last step in Risk Management. A Guide to the Project Management Body of Knowledge (PMBOK® Guide) Risk Management finally includes positive risk or opportunity which in many cases can dramatically contribute to extraordinary project success. There are three responses to Negative Risks or Threats:

1. Resolve / Eliminate /Avoid
2. Mitigate / Lessen Impact or Probability
3. Transfer / Insure / Contract – get rid of the risk

Opposite responses may be used in Positive Risk or Opportunity

1. Exploit – use the Opportunity – the opportunities may exceed all the threats in a project.
2. Enhance – increase the Impact. Use your best supervision on the critical path activities at night.
3. Share or Accept – keep ownership of the Risk or give to someone skilled in Exploiting that Opportunity. Use a time and material contract for example.

Much Risk can be eliminated by careful thorough planning. In pre-planning a project, identify the activities with the greatest number of unknowns which also have great impact on cost, time, or results. PETERS Principle says 5% of anything has 50% of the impact. What activities, what actions account for 50% of the duration, of the cost, of the opportunities, of the threats? Careful negotiation can identify those risks the project accepts or rejects – this is tough to do on internal projects but is especially beneficial. The better the planning (and scheduling) the higher the Quality of the project and lower the Risk either positive or negative.

As I watched one of the new houses on my commute burn, I reflected on Builder’s Risk Insurance. Being within an existing development, it appeared the homeowners owned the ground. I hoped they had insurance policies from the Builder on both liability and constructed project naming them as additional insured. This is both contracting away Risk (the Risk of building the house) and insuring the risk (for both the Homeowner and the Home Builder). It has set so long now with little activity that this probably is not the case.

The Risk You Know

From my experience, it is the Risk you know that bites you very similar to people are most frequently murdered by people they know. Our purpose is the drain the swamp but we may fall in love with wrestling alligators. We ignore lizards to go into the business of farm raised alligators. See Exhibit Three.

Exhibit Three

It is the Risks we know that we ignore or exaggerate that hurt us. On renovating a theatre, the designer said we would leave the main floor alone and not change it. I did not ask how much it will cost to renovate the main floor if that decision was overruled. We did not create a contingency plan. A Known Risk ignored.

Another example of Known Risks is the delay at our airport on the mid-field terminal caused by wood cribbing crushing under the weight of a huge roof beam. In construction, no one wants to address temporary supports because they are not part of the final product. This support appeared to be a box column made from cross stacked wood timbers. In the published photographs, the timbers appear to have crushed a foot or so but did not collapse causing the acres of roof to sag a bit. I speculate this is classic bearing failure – wood fibers can only carry so much load before they crush. The beams should have had a temporary bearing plate to transfer the load across more of the box column rather than just under the wide flange of the supported beam. Even if addressed, the weight of the interconnected roof may have increased the load on that beam beyond that of temporary support design. A Known Risk ignored.

We deal with the Known Unknown Risks such as precisely how long it will take to widen the proscenium arch from sixty feet to seventy-five feet plugging in a sufficiently large time estimate to deal with the worst case. We plan that work carefully weeks before it is needed reducing the duration by one third. This is a contingency built into the schedule for a Known Risk. Risk is resolved through planning and scheduling a specific event. It becomes more certain. Appropriate scope planning identifies these activities that require detailed planning and short-interval scheduling.

Unknown Unknown Risks have unallocated contingencies. My experience here is 20% -- twice I have been bitten simply by not having sufficient unallocated contingency. This contingency can be reduced as more is known about a project. The solution is to plan in detail – sometimes more than once -- carefully managing what ‘you know you do not know’ and ‘things we have avoided that we forget we are avoiding them‘. A quick path to disaster is to deny there are none of these risks and not to have a contingency.

Much Uncertainty can be made Certain by detailed planning and scheduling. I say again, Risk Management is a concurrent activity to Project Management not a separate phase. Project Management is Risk Management – making things Certain. Dealing with both Threats and Opportunities during Planning, Estimating, and Scheduling is required because the Risk Response can dramatically impact duration, cost, and quality.

Scope

Next in to search for Risk is to look for Uncertainty in Scope. Just describing what defines Scope is a challenge. Well defined Scope is more than the Work Breakdown Structure People love to guess at scope rather than do a detailed breakdown. Scope is perceived as plastic – it can be changed almost by whim if not by edict – scope is vastly underestimated or is politically manipulated to sell a project. There is a subconscious craving to say things are easier, safer, cheaper, or quicker than they really are. People do not take the time to plan – to create the project on paper from beginning to the end. There is a ‘and then the miracle happens’ syndrome in project scope. The uncertainty in under or un-estimated scope is, in my opinion, the common cause of project failure.

If you do not know high wide, how deep, how far, and which direction, you will have a high probability of not meeting cost and time constraints with an un-estimated scope. There is a lot of planning simply to get to a good scope. WBS must be taken to sufficient detail that allows the duration, effort (labor hours), and cost to be appropriately estimated. If you do not know the amount of work required to produce the result, how do you know how long it will take, how much it will cost, or how much labor required to do the work.

The questions to keep in mind as you evaluate your project for risk is scope:

1. Has all the work or deliverables been identified?
2. Will the customer stay within the Scope? How will it grow? What is the impact of this growth? Why will it grow?
3. Has the work been reduced into adequate chunks to plan effort (labor hours)? To calculate duration? To estimate cost? The PMBOK^® Guide is ambiguous in this arena, it asks for cost estimate but not for a schedule nor for a labor estimate. One can not have a cost estimate without a labor estimate (labor is 30% to 90% of project cost). Chunks should be less than five days in duration.
4. What are the possible changes, increases or decreases in the WBS?
5. Can we or our subcontractor produce each deliverable? How do we know?
6. What required supporting work is not in the deliverables, not in the WBS?
7. Is there a plan for each work activity (chunk)?
8. Does each deliverable have a labor estimate? How reliable is it?
9. Does each deliverable have a cost estimate? How reliable is it?
10. Does each deliverable have a duration estimate? How reliable is it?
11. How is the duration developed? Is the rough Network Diagram complete? Is its logic appropriate? Is its detail appropriate?
12. How is quality assured for each deliverable? Can we comply?
13. Do you know the level of uncertainty in each scope dimension? Are some deliverables more predictable than others? Which ones have 50% of the Risk?
14. Uncertainty in the Labor Plan? Probably under 25%.
15. How about the duration? Expert schedulers say that duration is minus 20% and plus 15%.
16. What is the accuracy of the cost estimate? Plus or minus 20%.
17. What is the impact of uncertainty of each on the other?
18. Does each of your support team have the skills, knowledge, and attitude required to complete their part of the scope and contribute to project team work?
19. Have you or someone you know personally witnessed the demonstration of these skills, knowledge, and attitudes?

Scope, from my perspective, is an experienced guess until the WBS is completed with a labor plan, cost estimate, and preliminary schedule. Then we can discuss the risk in scope. To evaluate risk in scope, you will have to evaluate risk in every element of the WBS. The elements of the WBS may match up with the 500 activities of the schedule.

What happens in many projects rather than the result dictating scope which defines cost, duration, effort. The reverse happens – what is available in labor, in cost, or in time dictates the scope – and people are puzzled when the result does not meet expectations. This is an enterprise management failure.

On one project, we did a detailed estimate and came in 25% over the budget – only a million dollars. We reduced the size of the project then waited four months getting a second estimate. The project was delivered for the budgeted value because we took the time to learn the scope. In this case, cost was a significant driver and time was flexible. We drove lots of risk out of the project by taking the time to get good cost estimates from the 50 or so subcontractors involved in the project. It was completed within this cost.

As a project manager, your job is to drive uncertainty out of a project. Your purpose is to ensure things are known, are communicated, are understood, are completed early (early start times like float are myths). You constantly monitor progress, effort, and cost against what was expected searching for deviations. You really do not manage the routine, you verify the routine, but you look for deviation, for surprises (to have a surprise you have to have a plan), for change from the expected.

To manage Risk in Scope, you have to be willing to invest the time to prepare a plan or you carry a great big contingency for all the things you know you do not know. Notice that in well planned work, the variation is easily 20%. Ignorant managers delete contingency – this happened on the ‘Big Dig’ in Boston and people are wondering why it was 20% over the budget.

The Risk Management project requires the listing of the risk and the probability it will occur. Guessing at that probability drives the Risk Response. Once risk is identified, one must predict the probability of occurrence which is a challenge but it can be done. What does 33% chance mean if that X scope item will delay four weeks (duration impact) because the work and productivity half the expected (labor increases by 100%)? That is one chance in three it will happen – a huge probability in our realm of making things certain.

Performance

The final project fundamental is performance – accomplishing the work of scope to produce the result. Remember discussing the work plan for each deliverable in scope? There must be a work plan for each of our 500 activities comprising the WBS or scope definition. It is only with a work plan that we are able to make things certain. I have heard some project managers say doing the work is the responsibility of the team member or subcontractor and how they do it is not anything the Project Manager should be concerned about as long as the work is completed on time.

This moves Risk onto the team member or contractor and leaves the Project Manager with no idea as to the Opportunity or Threat present.

Each work item of the WBS or activity of the schedule should have a work plan with cost estimate, labor plan, method, resources and network diagram. This is a work package. The Performance Risk – the Risk of Accomplishing the work -- in that work package should be searched.

These questions should be asked during the search for Uncertainty in Performance:

1. How is Performance to be measured? Will this measure impact Uncertainty in performing work? Will the measurement be sufficiently responsive to react to change? This reporting should occur at the minimum daily.

2. Are we capable of measuring progress, duration, labor hours? How do we take credit for earned hours? Are earned value hours consistent with the labor plan? Just how is productivity calculated?

3. Are the methods for each activity or work item defined? Is this the best proven method possible? Best Practices are Performance Enhancers.

4. Can we perform each method? How do we know?

5. Does our team or contractors have the technical skills required to accomplish the method? How do we know?

6. Will we get team synergism or will they work in parallel with little interaction? What is the opportunity in Team Work?

7. Resources – what is the Uncertainty or Risk in each resource for each work item or activity using these four dimensions? What assumptions have you made about each of these four dimensions for each Resource?

• Quantity – too few or too many will impact productivity and product quality. Timeliness is crucial.
• Quality – poor resources impact product quality and productivity.
• Value – cost or price variation can result in fewer resources, poorer quality, and sometimes lower productivity.
• Productivity – poorly supervised, poorly planned work can reduce productivity of resources. Waste reduces productivity of materials, tools, and equipment.

1. Supervision – supervision is a Performance multiplier.
2. People
3. Tools
4. Equipment
5. Materials
6. Information – availability can stop all progress; poor quality and slow progress.
7. Money
8. Time – perception of available time impacts productivity

8. What is the plan to start the project? The time with greatest Risk is start-up.

9. What velocity of progress is required? How will the project be accelerated to this velocity?

10. How will the project be finished? What is the closure plan?

The search for Uncertainty in Performance will occur during detailed planning of the 500 activities. Each activity has a unique set of resources integrated by the work method. The method itself must be evaluated for the quantity of work and how progress will be measured. Resources make or break the method. Resources can be evaluated globally across the project and at a micro level for each Activity. What is the Risk in each resource in each work activity? As a team or project manager experiences projects, the confidence of certainty will increase. Changes in teams, in type of project, in type of resource, in resource vender, in resource logistics inject uncertainty once again.