RISK PLANNING
AND
MITIGATION
1
Managing project risk
• Project risk management is the art and science of
• identifying,
• assigning, and
• responding to risk throughout the life cycle of a project.
• Risk management is often overlooked, but it can help to
improve project success by helping in
• Selecting good projects,
• Determining project scope, and
• Developing realistic estimates
2
What is risk?
• A dictionary definition of risk is “the possibility of loss
or injury”
• Project risk involves understanding potential problems
that might occur on the project and how they might
obstruct (or delay) project success
• Risk management is like a form of insurance; it is an
investment.
3
Risk Mitigation
• Risk mitigation planning is the process of developing
options and actions to enhance opportunities, and reduce
threats to project objectives.
• Risk mitigation implementation is the process of executing
risk mitigation actions.
• Risk mitigation progress monitoring includes
• tracking identified risks,
• identifying new risks, and
• evaluating risk process effectiveness throughout the project. 4
5
Common source of risks for IT projects
• Several studies show that IT projects share some common
sources of risk
• The Standish Group developed an IT success potential
scoring sheet based on potential risks
• McFarlan developed a risk questionnaire to help assess
risk
• Other broad categories of risk help identify potential risks
6
McFarlan’s risk questionnaire
1. What is the project estimate in calendar (elapsed) time?
( ) 12 months or less Low = 1 point
( ) 13 months to 24 months Medium = 2 points
( ) Over 24 months High = 3 points
2. What is the estimated number of person days for the system?
( ) 12 to 375 Low = 1 point
( ) 375 to 1875 Medium = 2 points
( ) 1875 to 3750 Medium = 3 points
( ) Over 3750 High = 4 points
3. Number of departments involved (excluding IT)
( ) One Low = 1 point
( ) Two Medium = 2 points
( ) Three or more High = 3 points
4. Is additional hardware required for the project?
( ) None Low = 0 points
( ) Central processor type change Low = 1 point
( ) Peripheral/storage device changes Low = 1
( ) Terminals Med = 2
( ) Change of platform, for example High = 3
7
PCs replacing mainframes
Risk types
• Market risk: Will the new product be useful to the
organization or marketable to others? Will users accept and
use the product or service?
• Financial risk: Can the organization afford to undertake the
project? Is this project the best way to use the company’s
financial resources?
• Technology risk: Is the project technically feasible? Could
the technology be obsolete before a useful product can be
produced? 8
What is project risk?
• The goal of project risk management is to minimize potential
risks while maximizing potential opportunities.
• Risk identification: determining which risks are likely to affect a project
• Risk quantification: evaluating risks to assess the range of possible
project outcomes
• Risk response development: taking steps to enhance opportunities and
developing responses to threats
• Risk response control: responding to risks over the course of the project
9
Identifying risk
• Risk identification is the process of understanding what
potential unsatisfactory outcomes are associated with a
particular project
• Several risk identification tools include checklists,
flowcharts, and interviews
10
Potential risk areas
Knowledge Area Risk Conditions
Integration Inadequate planning; poor resource allocation; poor integration
management; lack of post-project review
Scope Poor definition of scope or work packages; incomplete definition
of quality requirements; inadequate scope control
Time Errors in estimating time or resource availability; poor allocation
and management of float; early release of competitive products
Cost Estimating errors; inadequate productivity, cost, change, or
contingency control; poor maintenance, security, purchasing, etc.
Quality Poor attitude toward quality; substandard
design/materials/workmanship; inadequate quality assurance
program
Human Resources Poor conflict management; poor project organization and
definition of responsibilities; absence of leadership
Communications Carelessness in planning or communicating; lack of consultation
with key stakeholders
Risk Ignoring risk; unclear assignment of risk; poor insurance
management
Procurement Unenforceable conditions or contract clauses; adversarial relations
11
Quantifying risk
• Determine the risk’s probability of occurrence and its
impact to the project if the risk does occur
• Risk quantification techniques include
• expected monetary value analysis,
• calculation of risk factors,
• PERT estimations, simulations, and expert judgment
12
Expected Monetary Value
13
Expert judgment
• Many organizations rely on the intuitive feelings and past
experience of experts to help identify potential project
risks
• The Delphi method is a technique for deriving a
consensus among a panel of experts to make predictions
about future developments
14
Response to risk
• Risk avoidance: eliminating a specific threat or risk,
usually by eliminating its causes
• Risk acceptance: accepting the consequences should
a risk occur
• Risk mitigation: reducing the impact of a risk event
by reducing the probability of its occurrence
15
Risk Mitigation Strategies
Technical Risks Cost Risks Schedule Risks
Emphasize team support Increase the frequency of Increase the frequency of
and avoid stand alone project monitoring project monitoring
project structure
Increase project manager Use WBS and PERT/CPM Use WBS and PERT/CPM
authority
Improve problem handling Improve communication, Select the most experienced
and communication project goals understanding project manager
and team support
Increase the frequency of Increase project manager
project monitoring authority
Use WBS and PERT/CPM
16
Risk planning
• A risk management plan documents the procedures for managing risk
throughout the project
• Contingency plans are predefined actions that the project team will take if
an identified risk event occurs
• Contingency reserves are provisions held by the project sponsor for
possible changes in project scope or quality that can be used to mitigate
cost and/or schedule risk
17
Risk management questions
• Why is it important to take/not take this risk in relation to the project
objectives?
• What specifically is the risk and what are the risk mitigation deliverables?
• How is the risk going to be mitigated? (What risk mitigation approach is
to be used?)
• Who are the individuals responsible for implementing the risk
management plan?
• When will the milestones associated with the mitigation approach occur?
• How much is required in terms of resources to mitigate risk?
18
Risk Mitigation
•After the risk has been identified and evaluated, the project
team develops a risk mitigation plan, which is a plan to
reduce the impact of an unexpected event.
•The project team mitigates risks in various ways:
•Risk avoidance
•Risk sharing
•Risk reduction
•Risk transfer
19
