Project Management Foundations: Risk

Project risk: A product of uncertainty

The Project Management Institute (PMI) defines uncertainty as “a lack of understanding and awareness of issues, events, paths to follow or solutions to pursue.” PMBOK Guide, Seventh Edition, Project Management Institute.

Risks
Events that can have an impact on your project but have not yet occured.

Issues
Things that have already occurred on your project, and the impact is being felt.

Reduce and Manage Risk

1. Leverage your project team and key stakeholders.
2. Think through possible outcomes.
3. Consider other approaches to completing project tasks.
4. Have a plan B.

The risk management process

1. Build a risk plan
   • Outlines the tools and approaches you’ll use to manage risks.
2. Identify risk
   • Brainstorm for good risk (opportunities) and bad risks
3. Perform risk analysis
   • Determine risk impacts
     • Cost
     • Lost time
   • Estimating risk probabilities
     • Low
     • Medium
     • High
4. Plan risk responses
5. Implement risk responses
   • Under what conditions will you respond to a risk
6. Monitor risks
   • Assess the effectiveness of risk responses

Managing risk, ambiguity, and project stakeholders

Ambiguity
The quality of being open to more than one interpretation.

Ask better questions to clarify ambiguity.

Conceptual Ambiguity
Interpreting a sentence in more than one way.

Situational Ambiguity
When more than one solution pathway or outcome can result from a project decision.

Discuss requirements or solutions documents with customers before finalizing.

Dealing with volatility in a project environment

“Rapid change of conditions in all human affairs bring unexpected results” – William C. Oates.

Common Project Changes

• Key stakeholders
• Available skill levels
• Sponsor expectations or concerns
• Technology
• Risks

Ready for Volatility

• Keep a one-page project purpose and status summary up to date.
• Have a single-page presentation that describes the outcomes your project.
• Understand available staffing options and impacts.
• Get to know your sponsor.

The components of a project management risk plan

Risk Management Plan

• Identified
• Evaluated and analyzed
• Dcoumented
• Controled and managed
• Reported
• Roles and responsibilities
• Communication
• Glossary
• Budgeting approach
• Risk review process

Project risk identification methods

Identifying Risks in a Project

1. Review prior projects and their records.
2. Talk with your stakeholders.
3. Utilize artificial intelligence (AI)
4. Observe how people work in their environment.

Hold a risk identification workshop to compile the information.

Review the risks with senior managers in one-on-one interviews.

Project threats

Decrease exposure to negative risks (threats).

Threat Strategies

• Avoid – change project scope
• Escalate – threat is outside of project scope or exceeds the PM’s authority
• Transfer – give the problem to someone else – like a third party (expert vendor or insurance)
• Mitigate – find ways to reduce them – hire a consultant/backfill resources
• Accept – accept the existence of the threat for low probability and low impact

Risk mitigation should be:

• Realistic and cost effective
• Necessary given the threat’s magnitude
• Agreed to by relevant stakeholders
• Assigned to an owner
• Have the potential to reduce the impact and/or the probability of the risk occuring

Throughout the project lifecycle you can change the strategy for a given threat.

Project opportunities

Positive risks are also called opportunities

Opportunity Strategies

• Exploit
• Escalate
• Share
• Enhance
• Accept

Risk mitigation should be:

• Realistic and cost effective
• Apropriate
• Agreed to by relevant stakeholders
• Assigned to an owner

Building project resiliency

Project Resiliency
The ability of a project to absorb impactful events and continue delivering value to the organization.

Effective Project Resiliency

• Pre-planning risk audits
• Risk response executed thus far
• Brainstorm new risks

Increase Project Resiliency

• Continuous cross-training
• Minimum viable product (MVP)
• Stakeholder redundancy
• Maximize decision velocity

Understanding risk appetite and tolerance

Risk Appetite
The degree of uncertainty an organization or individual is willing to accept in anticipation of an award.

Risk appetite = Risk tolerance

Risk Tolerance

• Safety
• Regulatory conditions
• Scope, time and cost
• Product outcomes vs. business benefits
• Speed to market
• Deliverable quality
• Sustainability

Managing Risk Appetite and Tolerances

1. List all major categories of risk.
2. Rank risk appetite for each category as high, medium and low.
3. Define tolerance levels in each category.

Tolerance levels can change as the project progresses.

Determining project risk analysis level

Analyzing Risk

1. Impact
2. Probability

Budgeting for risk

• Work with your sponsor to budget for risk.
• Include contingency reserve funds

“Contingency reserves are set aside to implement a planned risk response or to respond to respond to risk events that happen.” – PMBOK 7th Edition

Funding Risk Responses

1. Identify activities (cross training, buy insurance, engage two vendors, etc.)
2. Allocate the contingency reserve.
3. Allocate management reserve (for unknown risks).

Tailoring risk plans

Tailoring Characteristics to Consider

• Project size and complexity.
• Risk appetite and threshold.
• Holistic view of risk management.
• Strategic importance.
• Development approach.

Reduce Risk for Larger, Complex Projects

• Structure the project with shorter phases
• Cross-train staff
• Maintain skilled vendor contracts on standby

Consider your development approach (Agile vs. Waterfall) as this impacts the amount of risk during the project life cycle.

Project vs. Task Risk

Task Level Risks
Events that would impact one or a few tasks in your project.

Project Level Risks
Things that could happen that can have an immediate, notable impact on project outcomes.

Monitor project level risks closely. Task level risks can become project level risks if they go unmanaged or undetected.

Managing project risk strategically

A project can present strategic opportunities and threats to the business.

Strategic Risks

• Regulatory
• Competitor
• Economic

Information Sources to Manage Strategic Risks

1. Look at key performance indicators (KPIs).
   • Look for events that indicate a risk is happening (risk triggers).
2. Audit activities.
3. Research your competitors.
   • Align your project with overall business activities.
4. Check if AI introduces additional strategic risks.

Knowns and unknowns

Classifications of Risk

• Known-knowns
  • Facts we can confirm, stakeholder requirements we have documented and can verify, and conditions we must meet.
• Known-unknowns
  • Risks that you can know can occur, with an unknown element.
• Unknown-knowns
  • Things that we don’t know, but others do.
  • For example: it’s unknown when a competitor would release a new product, but they do!
• Unknown-unknowns
  • Something unexpected and information about it’s impact is also uknown

A typical contingency is to always add an additional 5% to the budget or an additional week to timelines spanning over three months.

Managing unknown unknowns

Examples of Unknowns Unknowns

• Team members might get sick and miss deadlines. (Known Unknown)
• A sinkhold appearing out of nowhere
• A pandemic

Dealing with Unknown Unknowns

1. Focus on impacts.
2. React
3. Don’t assume it’s always unknown.
4. Seek out knowledge in project records.

Identifying risk triggers

Risk Trigger
An event or circumstance that a risk might be occuring.

1. Fewer hours than planned spent working on project with tasks not being completed.
2. Estimation optimism

Leading Indicatiors

1. Snow-plowing – task pushout to future sprints
2. Frequent change requests from stakeholder group.

Uncertainty of requirements and technology

“We crave explanations for most everything, but innovation and progress happen when we allow ourselves to embrace uncertainty.” – Simon Sinek, British-American Author and Speaker

Addressing Project Uncertainty

• Agile approaches – delivers small features quickly – allows for uncertainty.
• Deal with it early – waiting to address areas of uncertainty is risky.
• Plan for change events in advance.
• Don’t rush – spend time refining requirements with stakeholders.

Challenge: Staffing uncertainty

Conditions for an effective Risk Response

• Appropriate to the risk’s significance
• Cost effective
• Realistic
• Agreed to
• Owned by someone

Solution: Staff uncertainty

Problem: Sub-contractor firm may be going out of business and your project relies on the skills of the sub-contracts that you don’t have in your in-house employees.

Recommended Risk Responses

• Contract firm
  • Assign someone from procurement to speak with the contracting firm about the rumors.
  • Discuss the possibility of hiring those contractors if the firm goes out of business.
  • Look at contracting directly with the individuals most important to the project.
  • Examine the possibility of contracting with a different firm.
• Training
  • Ask skills development team about training opportunities for in-house resources.
• Alternavites
  • Assig lead technical team member to investigate alternatives

Challenge: Requirements volatility

Problem: Road construction project that travels through three towns. You established good relationships with town governments. Preliminary survey discovered a clay compound and second an election is scheduled for town mayor in one of the towns that you negotiated the road pathway.

Solution: Requirements volatility

Recommended Risk Responses

• Clay
  • Order more detailed soil samples to determine actual risk of the clay.
  • Work with road design team to determine bypass options.
  • Check road building technologies for a way to build on the clay without experiencing cracking.
• Mayor
  • Try to interview the mayoral candidate to get their views on the new road.
  • Explain why the current routing has been agreed.

Challenge: Technology deployment

Problem: Replace a 25-year old warehouse and production distribution system (WPD). Most of the staff has been around as long as the system has been in effect. This will acquire your IT team to obtain new skills.

Solution: Technology deployment

• New System
  • Address the shock of dealing with a big new system.
  • Technical and business representatives go through new processes step by step.
  • Talk with others that have implemented the system in other businesses.
• IT
  • Have fund available for a technical team.
  • Open a new systems lab for users.