Project Risk Management

• Formal project risk management includes qualitative analysis of individual risks and quantitative analysis of overall project cost and schedule risks.
• Both qualitative and quantitative analyses are valuable practices for projects where performance and risk understanding are key to stakeholders.

Difference Between Individual and Overall Risk Assessments

• Overall project cost and schedule risk assessment cannot be determined effectively by aggregating individual risks.
• Individual risk assessments are relative and qualitative, not providing absolute cost or schedule impacts.
• Individual risks can interact in complex ways, potentially skewing analysis.
• Comparing best-case and worst-case scenarios may yield information of limited use due to the broad range of possibilities.
• Individual risk analysis and overall project risk analysis each have distinct purposes.
• Overall project risk assessment helps stakeholders decide if project outcomes are acceptable given risk tolerance.
• Risk analysis can lead to changes in project objectives before project start.
• Identifying and assessing individual risks facilitates overall risk assessment and enables specific actions to reduce impacts.

Performing Individual (Qualitative) Analysis of Project Risks

• Individual risk analysis qualitatively assesses risk-severity levels for each identified project risk.
• Severity assessments help prioritize responses and establish risk reserves (budgetary and schedule).
• This analysis is typically done during project planning and may result in iterations before the plan of record (POR) is finalized.
• Risk planning can disrupt project planning, causing changes and trade-offs potentially compromising project objectives.
• Risk-severity assessments and rankings facilitate selecting risk responses.
• These assessments enable risk categorization and provide rationale for establishing risk reserves (contingency and management buffers).
• Project risk reassessments occur throughout the project lifecycle as risks materialize or new risks are identified.
• Risks might become issues, be eliminated, or reduced to manageable residual risks.
• Frequent reassessments are necessary to maintain project control from a risk perspective, and can be planned or event-driven.

Risk Management Tools and Techniques for Qualitative Analysis

• Project teams use risk management formally or informally.
• The effectiveness and cost of risk management tools and techniques vary in complexity.
• More effective techniques are typically more costly.
• Organizational support infrastructure is needed to implement complex tools and techniques effectively.
• Simpler techniques are less complex but also less effective.

Informal (i.e., Reactive) Risk Management

• Not all projects undertake formal qualitative risk management.
• Even low-risk projects will adapt some process for dealing with issues as they occur.
• Informal risk management monitors project and product issues, reacting as needed.
• This approach is suitable when many potential risks have a low likelihood and impact, or are too random to prevent proactively.
• Using informal risk management as the primary process on complex projects can create a crisis culture.
• It works for follow-on production involving stable products and processes like addressing unexpected changes or compatibility issues.

Use of a Simple Risk Register

• A simple risk register lists risks with their categories (technical, cost, schedule).
• Risk registers include subjective risk assessments (high, medium, low) and planned mitigation actions.
• Deriving and assessing risks is typically informal and based on expert judgment.
• The effectiveness of this approach depends on the expertise of those providing the inputs and the project's scope and complexity.

Formal Risk Planning (Using a Risk Matrix)

• A popular approach involves using a risk matrix with a detailed risk register.
• This produces risk-severity ratings based on the probability and impact if risks materialize.
• Many configuration options exist for the specific design of the tool.
• Organizations standardize the methodology for consistency.
• The tool’s popularity stems from its relative ease of use, general applicability, and effectiveness.
• A detailed risk register supports the process of using risk matrix.
• The risk matrix is a visual aid for evaluating individual risks and communicating assessment results.
• The risk register holds risk identification, assessment, and response information.
• It provides risk-severity scores and metrics for prioritizing and funding responses.
• The risk matrix should be in the risk management plan (RMP) with agreed probability and impact scales.
• A common format is a 5 × 5 risk matrix.
• Some matrices evaluate only risks (threats).
• Other versions include opportunities.
• The matrix design (e.g., 3 × 3, 5 x 5, 10 x 10) depends on organizational preference.
• Since the severity score is a relative measure for comparing risks, the absolute value isn't critical; a scale with integer values is used.

Individual Project Risk Prioritization

• A benefit of risk-severity ratings is that they relate to the same evaluation criteria and can be compared.
• Higher severity ratings suggest a higher priority for resource allocation.
• Severity alone may not suffice, especially with limited funds
• An understanding of likely risk responses needs to be included in the selection criteria.
• The timing of risk events also needs to be considered.

Risk Event Timing Prioritization

• The later the risk event within the project life cycle, the costlier it will be to adjust the project plan if there are issues.
• Action must be taken to lessen their impact and/or move the risk event date earliear.

Incremental Project Cost Prioritization

• Varying levels of funds will be needed to respond to risks
• A low cost coupled with a risk could warrant a higher priority.

Risk Prioritization Based on the Cost per Severity Point Reduction

• Risk responses will not always eliminate all risks and some may remain.
• If similar risks that would normally be weighted the same exist, the response that takes the overall qualitative risk level down the most is the most cost-effective and must be given priority.

Identifying, Assessing, and Planning Responses for Notional Project

• The project team re-evaluated risks due to plan changes, identifying three major risks.
• Example of risks from the plan were: possibility of need of an extra design/build/test cycle, scarcity of raw materials, and the machine shop being overbooked.
• Actions like building rapid prototypes and peer design reviews were implemented to lower severity.
• The team managed Risk C by planning fabrication both in-house and at another supplier.

Notional Project Risk Burn-Down Schedule

• The risk burn-down schedule plots total risk severities over time.
• It can be used to compare with future status.
• The design for this project would be rapidly prototyped to determine if final design changes were appropriate.
• The final design adjustments would be verified by building an actual part.