Risk management :
best practice &
future developments
Presented by
Dr David Hillson FAPM FIRM PMP
Director Risk Doctor & Partners
[email protected] www.risk-doctor.com
© 2004 David Hillson/Risk Doctor Limited, Slide 1
What is
“best practice”?
z “Routine activities that lead to excellence”
z Not “what everyone does”…
… but “what everyone should do”
z Accepted by leading professionals
z Implemented by leading practitioners
z Widely accessible
z Scaleable, easily tailored or modified
© 2004 David Hillson/Risk Doctor Limited, Slide 2
Copyright © 2004 David Hillson/Risk Doctor Limited Page 1
1
Various approaches
Vision Strategy Programme Project Tasks
Corporate governance/PD6668
MoR (OGC) 2002
RAMP (ICE) 2002
BS6079-3:2000
IRM/AIRMIC/ALARM:2002
AS/NZS 4360:2004
PRAM (APM) 2004
PMBoK (PMI) 2004
© 2004 David Hillson/Risk Doctor Limited, Slide 3
Elements of best practice
z Definition of “risk”
z Components of process
© 2004 David Hillson/Risk Doctor Limited, Slide 4
Copyright © 2004 David Hillson/Risk Doctor Limited Page 2
2
Where does risk come from?
All projects contain risk, arising from interactions between
• objectives ...
• what must happen
• uncertainty ...
• what might happen
TIME
UNCERTAINTY UNCERTAINTY
UNCERTAINTY
COST QUALITY / PERFORMANCE
© 2004 David Hillson/Risk Doctor Limited, Slide 5
What is a risk?
“An uncertain event or set of circumstances that,
should it occur, will have an effect on achievement of
one or more of the project’s objectives”
(APM PRAM Guide)
Risk connects uncertainty with objectives
“The combination of the probability of an event
and its consequences”
(IRM/AIRMIC/ALARM RM Standard)
© 2004 David Hillson/Risk Doctor Limited, Slide 6
Copyright © 2004 David Hillson/Risk Doctor Limited Page 3
3
Two dimensions of risk
Risk has two dimensions :
1. uncertainty
2. effect on objectives
“probability”
“impact”
Risk connects uncertainty with objectives
© 2004 David Hillson/Risk Doctor Limited, Slide 7
Two dimensions of risk
z Uncertainty estimated as “probability”
z “Impact” assessed against objectives
z But what kind of impact?
z Could be either positive or negative
z Uncertainty that helps as well as
uncertainty that harms
z Opportunities as well as threats
© 2004 David Hillson/Risk Doctor Limited, Slide 8
Copyright © 2004 David Hillson/Risk Doctor Limited Page 4
4
Two-dimensional definitions
z APM PRAM Guide (second edition) :
z “Uncertainty can affect achievement of project
objectives either positively or negatively. The
term ‘risk event’ is therefore used to cover both
uncertainties that could hinder the project (threats)
as well as uncertainties that could help the project
(opportunities).”
z PMI® PMBoK® Third Edition :
z “An uncertain event or condition that, if it occurs,
has a positive or negative effect on a project
objective.”
© 2004 David Hillson/Risk Doctor Limited, Slide 9
Two levels of risk
z APM PRAM Guide (second edition)
z “risk event … an individual uncertainty which can
be identified, assessed & managed … defined as
‘An uncertain event or set of circumstances that,
should it occur, will have an effect on achievement
of one or more of the project’s objectives’.”
z “project risk … the joint effect of risk events &
other sources of uncertainty … defined as ‘The
exposure of stakeholders to the consequences of
variations in outcome’.”
© 2004 David Hillson/Risk Doctor Limited, Slide 10
Copyright © 2004 David Hillson/Risk Doctor Limited Page 5
5
Best-practice process
Why bother? INITIATE
MANAGE
What are the risks? IDENTIFY
How are we getting on?
Are they significant? ASSESS
PROCESS
What can we do?
PLAN RESPONSES
What will we do?
IMPLEMENT
Do it !!!
RESPONSES
© 2004 David Hillson/Risk Doctor Limited, Slide 11
Risk assessment
z Qualitative assessment z Quantitative assessment
z What is the risk? z modelling uncertainty
z Why might it occur? z simulate combined effect of risks
z How likely is it? (Probability) z predicting outcomes
z How bad/good might it be? (Impacts) z range, min/max, expected
z Does it matter? z testing scenarios
z What can we do? z setting confidence limits
z When should we act? z identifying criticalities
z Who is responsible? z determining options
z Record/analyse in Risk Register z Model in software
© 2004 David Hillson/Risk Doctor Limited, Slide 12
Copyright © 2004 David Hillson/Risk Doctor Limited Page 6
6
Qualitative techniques
1. Probability/Impact matrix
PROBABILITY
VHI
z define terms HI/MED/LO
HI
z prioritise risks R/Y/G
MED
2. Risk categorisation (RBS) LO
z common sources VLO
z “hot-spots” of exposure VLO LO MED HI VHI
Project IMPACT
Risk
Management
Technical Commercial
Risk
Risk Risk
Performance Safety Reliability Resources Information Communication Contractual Organisational
© 2004 David Hillson/Risk Doctor Limited, Slide 13
The “mirror” double P-I Matrix
Use two matrixes : rotate opportunity half
THE
ATTENTION
ARROW
VHI
VHI
PROBABILITY
PROBABILITY
HI
HI
MED
MED
LO
LO
VLO
VLO
VLO LO MED HI VHI VHI HI MED LO VLO
NEGATIVE IMPACT POSITIVE IMPACT
(Threats) (Opportunities)
© 2004 David Hillson/Risk Doctor Limited, Slide 14
Copyright © 2004 David Hillson/Risk Doctor Limited Page 7
7
Risk response planning
z Using risk information to make decisions
z Based on :
z type & nature of risk
z manageability
z impact severity
z resource availability
z cost-effectiveness
z Identify :
z best owner for response
z appropriate response
z effective management action
© 2004 David Hillson/Risk Doctor Limited, Slide 15
Threats & opportunities
THREAT GENERIC STRATEGY OPPORTUNITY
Avoid ELIMINATE UNCERTAINTY Exploit
Transfer ALLOCATE OWNERSHIP Share
Mitigate MODIFY EXPOSURE Enhance
Accept INCLUDE IN BASELINE Accept
© 2004 David Hillson/Risk Doctor Limited, Slide 16
Copyright © 2004 David Hillson/Risk Doctor Limited Page 8
8
Benefits
Do it because it works (for you)
z Hard benefits z Soft benefits
z credible plans z improved communication
z increased chance of success z common understanding
z better contingency z develops risk awareness
z metrics for future projects z focuses attention
z comparison of alternatives z facilitates risk-taking
z identifies best risk owner z demonstrates professionalism
© 2004 David Hillson/Risk Doctor Limited, Slide 17
Vision for the future
z Risk management is not static
z still developing and moving forward
z Three areas for development
z integration
z increased depth & breadth
z behavioural aspects
© 2004 David Hillson/Risk Doctor Limited, Slide 18
Copyright © 2004 David Hillson/Risk Doctor Limited Page 9
9
Integration
z Integral to management of projects
z culture
z process
z tools
z Integral to corporate culture
z Enterprise risk management
z across the business, top to bottom
z TRM :
z a way of thinking
z attitudes lead to actions
© 2004 David Hillson/Risk Doctor Limited, Slide 19
Increased depth & breadth
z Depth of risk analysis
z better tools & techniques
z user-friendly
z functionality
z integration
z use of AI, IKBS, expert systems
z knowledge management
z learning from experience
z draw on other disciplines
z value management
z system dynamics
z safety and hazard analysis
z scenario planning © 2004 David Hillson/Risk Doctor Limited, Slide 20
Copyright © 2004 David Hillson/Risk Doctor Limited Page 10
10
Increased depth & breadth
z Breadth of application
z not just threats to project time & cost
z risk as opportunity
z other objectives : performance, quality …
z soft objectives : environment, HF, reputation …
z programme/portfolio risk assessment
z inter-project issues
z business risk assessment
z business drivers, investment appraisal
z corporate governance, holistic risk
© 2004 David Hillson/Risk Doctor Limited, Slide 21
Behavioural aspects
z Risk is not managed by robots
z Human psychology is major influence
z Awareness Ö understanding Ö modification
z “Know thyself ”
z Aim for “risk maturity”
z Appropriate choice of attitude & approach to
meet specific needs of situation
© 2004 David Hillson/Risk Doctor Limited, Slide 22
Copyright © 2004 David Hillson/Risk Doctor Limited Page 11
11
Risk attitudes
z Range :
z Risk-averse
z Risk-neutral
z Risk-tolerant
z Risk-seeking
z Why does it matter?
z Attitudes create heuristics
z Heuristics influence judgement
z Need to identify & manage risk attitudes
z Personal and corporate
z Develop emotional literacy
© 2004 David Hillson/Risk Doctor Limited, Slide 23
Where are we going?
z Project risk management has a future
z not just a passing fad
z Develop or die
z pioneers or settlers
z Do it - because it works!
j d i !!
© 2004 David Hillson/Risk Doctor Limited, Slide 24
Copyright © 2004 David Hillson/Risk Doctor Limited Page 12
12
More information from David Hillson
[email protected] www.risk-doctor.com
© 2004 David Hillson/Risk Doctor Limited, Slide 25
Copyright © 2004 David Hillson/Risk Doctor Limited Page 13
13
